Why does credential phishing still work in organisations with mature email security?

Because email security is only one layer of the identity attack surface. Attackers increasingly use SMS, collaboration apps, QR codes, and voice calls to reach users through trusted channels. If identity controls depend on a single message gateway, the organisation has defended the mailbox but not the credential itself.

Why This Matters for Security Teams

Credential phishing remains effective because modern attackers rarely need to break email controls when they can redirect the user into a trusted channel and capture the same identity factors there. Email gateways, URL rewriting, and attachment sandboxing reduce one slice of risk, but they do not stop token theft, session hijacking, or real-time credential relay once a user is convinced to act. The problem is identity abuse, not just message delivery abuse.

Mature programs often assume that stronger filtering equals stronger resilience. In practice, attackers pivot to SMS, collaboration apps, QR codes, and voice calls because those paths sit outside the most heavily tuned inbox defenses. The NIST SP 800-63 Digital Identity Guidelines treat authentication assurance as a broader problem than a single channel, and NHIMG research on Cisco Active Directory credentials breach shows how exposed credentials can become a wider identity compromise, not just an email incident. In practice, many security teams encounter credential theft only after a valid login has already been used elsewhere, rather than through intentional mailbox compromise.

How It Works in Practice

The attacker’s goal is usually to harvest a password, MFA code, session token, or OAuth grant from a channel the user already trusts. Once the phish leaves email, the control problem shifts from content inspection to identity validation. That is why OWASP Non-Human Identity Top 10 and related identity guidance are useful even in human phishing cases: the real target is often the credential or token, not the inbox.

Effective defenses layer controls across the whole authentication path:

• Use phishing-resistant MFA where possible, especially for admins and high-risk applications.
• Reduce reliance on reusable secrets by preferring short-lived tokens and session-bound proof.
• Detect impossible travel, device changes, and unusual consent grants after authentication.
• Harden SMS and voice recovery paths, since attackers often use them to bypass stronger primary controls.
• Train users on cross-channel phishing, including QR scams and collaboration-platform impersonation.

NHIMG’s Ultimate Guide to NHIs — Static vs Dynamic Secrets is relevant here because credential value changes based on lifetime and reuse. A long-lived password or token gives an attacker a much larger window than a short-lived, bound credential. That same logic appears in Guide to the Secret Sprawl Challenge, where secret exposure becomes a persistence problem as much as an access problem. These controls tend to break down in environments that still allow legacy MFA, broad session duration, and password reset flows that rely on the same compromised channel.

Common Variations and Edge Cases

Tighter authentication often increases user friction and support load, so organisations have to balance phishing resistance against adoption and business continuity. Best practice is evolving, and there is no universal standard for every workforce or customer-facing flow.

Some environments are especially vulnerable:

• Hybrid workforces that depend on personal mobile numbers for MFA and recovery.
• Executive and finance teams targeted through voice phishing and urgent approval requests.
• Collaboration-heavy organisations where attackers impersonate internal staff in chat tools.
• Third-party access models where a phished vendor account can reach internal systems.

The strongest programs treat email security as a detection layer, not a perimeter. They pair it with step-up authentication, device trust, consent governance, and rapid revocation of sessions and tokens after suspicious login activity. NHIMG’s research on the Guide to the Secret Sprawl Challenge reinforces the same lesson: once a secret is exposed, containment speed matters as much as prevention. The edge case that often surprises mature organisations is a successful login that looks legitimate because the attacker used the right channel, the right timing, and the right amount of user pressure.

Related resources from NHI Mgmt Group

• How should security teams reduce the risk of voice phishing in identity workflows?
• How should security teams use secure email gateways without overrelying on them?
• Why do compromised email accounts still create business email compromise risk?
• What breaks when organisations rely on email as the main approval channel?