Yes, when the attacker can render the real page and relay authentication in real time. URL filtering still helps at the perimeter, but it cannot be the only line of defence. Session monitoring, inbox telemetry, and identity-aware analytics are more durable controls against proxy-based phishing.
Why Modern Phishing Changes the Control Trade-off
Modern phishing is often a live interaction problem, not just a bad-link problem. If the attacker can proxy the real site, relay credentials and capture the authenticated session, a URL block alone may never see a visibly malicious destination. Session-aware controls are stronger because they look for abnormal use after login, when the fraud becomes operationally real.
URL filtering still matters at the edge, especially for commodity lures and known malicious infrastructure. But it is easier to evade when attackers use fresh domains, compromised sites, redirect chains or real-time reverse proxies. Controls that see the session, token use and user behaviour provide a better chance of spotting abuse after the browser has already reached the legitimate service.
For that reason, this is not a choice between perimeter control and identity control. The better question is which layer is more resilient when the phish is interactive. In proxy-based attacks, the answer is usually session monitoring first, with URL filtering treated as an upstream filter rather than a final assurance layer.
What Session Monitoring Adds That URL Filtering Cannot
Session monitoring focuses on the authenticated state rather than the initial click. That lets defenders see token replay, impossible travel, atypical device context, unusual browser signals, rapid privilege change or suspicious access sequences that occur after the user has already passed the phishing page. It is especially useful when the attacker has a valid session and no longer needs the original lure.
URL filtering is still valuable for blocking obvious phishing infrastructure and reducing exposure to known-bad domains. Yet it is structurally weaker against live phishing kits, adversary-in-the-middle proxies and brand-new delivery domains. A filter can stop many first-stage attempts, but it does not understand whether a session that looks valid is being abused in a way that breaks normal user behaviour.
That is why inbox telemetry, identity-aware analytics and session signals need to be correlated. A suspicious email, a risky sign-in and a new session from an unusual context together create a much stronger detection picture than any one of them alone. This is also why organisations that rely heavily on browser or gateway blocking should still expect successful phishing to occur.
How to Decide What to Prioritise
If the main threat is commodity phishing with known malicious links, URL filtering is useful and should remain in place. If the main threat is modern phishing that can render the real login page and steal the authenticated session in real time, session monitoring deserves higher priority because it addresses the post-authentication abuse that filtering misses.
Use a layered view: perimeter controls reduce volume, but session controls reduce impact. The practical decision is often about blast radius. When a phish succeeds, what gives defenders the fastest path to detection and containment? In most modern phishing cases, it is not the blocked URL, it is the abnormal session.
To make that work, the monitoring plan needs defined escalation thresholds. Focus on sign-ins that combine a new device or location, unusual token behaviour, impossible travel, risky inbox activity or rapid access to sensitive actions. Those are the conditions where the phish has moved from exposure to compromise.
Risk and Threat Considerations
Modern phishing becomes materially more dangerous when the attacker can defeat the initial URL gate and operate inside a valid session. That shifts the problem from content filtering to identity abuse, where the real failure is not the click but the compromised authenticated state.
Failure mechanism: Attackers use reverse-proxy or token-relay methods to harvest credentials and session material in real time, then act as the user from a context that appears legitimate to simple perimeter filters.
Impact: Organisations can miss account takeover, sensitive mailbox access, internal lateral movement and follow-on fraud even when the original phishing URL was never broadly visible or remained short-lived.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-8 — Audit Log Management | Session monitoring depends on reliable authentication and session logs. |
| Recommendation — Centralize session, sign-in and email telemetry for rapid phishing detection. | ||
| NIST CSF 2.0 | DE.CM-09 — Malicious code and indicators of compromise are detected | Phishing defence needs ongoing monitoring for suspicious sign-ins and session abuse. |
| Recommendation — Correlate identity and session signals to detect active phishing abuse. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Real-time phishing defeats weak assurance unless sessions and authentication context are stronger. |
| Recommendation — Use phishing-resistant authentication and step-up checks for risky sessions. | ||
| ISO/IEC 27001:2022 | A.8.16 — Monitoring activities | Session monitoring is an operational monitoring control for detecting abuse after login. |
| Recommendation — Define monitoring rules that flag anomalous authenticated sessions. | ||
Practitioner Guidance
What to prioritise: Put your best detection effort where the compromise becomes durable, which is the session. URL filtering should stay in place, but it should not be the control you trust most when phishing kits can proxy the real service.
What to verify: Confirm that your telemetry can correlate email indicators, sign-in risk, device context and session anomalies across the same user journey. If those signals live in separate tools with no shared investigation path, detection will lag the attack.
What good looks like: A suspicious login should produce a fast, explainable response decision, such as step-up verification, session revocation or account review, based on the behaviour of the live session rather than the reputation of the original URL.
Practitioner takeaway: For proxy-based phishing, the decisive control is the one that can still see abuse after the user has already authenticated.
Useful references for the control mix include Privileged Session Management Guide, CIS Controls v8, NIST Cybersecurity Framework 2.0 and NIST SP 800-63 Digital Identity Guidelines.
Related resources from NHI Mgmt Group
- Should organisations prioritise runtime monitoring over stricter API request filtering?
- When should organisations prioritise NHI monitoring over more access approvals?
- Should organisations prioritise session monitoring or credential rotation first?
- Should organisations prioritise phishing-resistant MFA over other identity projects?