Why do phishing campaigns still work even when organisations have security tools in place?

They often succeed before tooling has a chance to intervene. Modern phishing uses urgency, familiar brands, and multiple channels to push a user into entering credentials or payment data, which means the control failure is frequently human decision speed rather than missing detection logic.

Why This Matters for Security Teams

Phishing still works because many campaigns are built to outrun the organisation’s own control stack. Email filtering, browser protection, and MFA help, but they do not stop a user from approving a login, entering a password into a fake portal, or moving into a second channel such as SMS or OAuth consent. NIST’s control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls makes clear that technical safeguards only work when they are paired with process, monitoring, and identity controls.

The real problem is that phishing is no longer just an email problem. Attackers now chain brand impersonation, QR codes, callback lures, and token theft to bypass the moment when a tool would normally intervene. NHIMG research on the CoPhish OAuth Token Theft via Copilot Studio shows how quickly social engineering moves into identity abuse once a user is persuaded to act. That is why visibility alone is not enough; the gap is often between user action and enforcement, not between alerting and detection.

In practice, many security teams encounter compromise only after a valid session, token, or payment approval has already been used to make the phishing look legitimate.

How It Works in Practice

Modern phishing succeeds by collapsing the distance between deception and execution. A message creates urgency, the target clicks, and the next step is framed as normal business activity: sign in, approve the app, confirm the invoice, reset the password, or review the shared file. At that point, the attacker is not trying to break security controls directly. They are trying to get the user to invoke them on the attacker’s behalf.

That is why email security tools can be present and still insufficient. The message may arrive through a trusted SaaS workflow, a collaboration platform, or a compromised account rather than a plain malicious email. Once a credential, one-time code, OAuth grant, or session cookie is captured, the attacker can reuse legitimate identity proof and often sidestep the controls that were designed to stop obviously malicious traffic. NIST guidance emphasises layered control, while identity-focused monitoring helps catch the part that perimeter tools miss.

• Block known-bad infrastructure, but also monitor for lookalike domains and consent phishing.
• Enforce phishing-resistant MFA where possible, because push fatigue and code interception remain common failure points.
• Apply conditional access and session risk checks so a stolen token is less useful outside expected context.
• Review OAuth app grants, mailbox rules, and forwarding settings, since attackers often persist after the first login.

NHIMG’s coverage of the DeepSeek breach is a reminder that exposed credentials and weak containment can turn a single successful lure into broader compromise. The practical lesson is simple: phishing defense must cover identity use, not just message delivery.

These controls tend to break down in organisations with legacy authentication, weak OAuth governance, and user workflows that rely on rapid approval without independent verification.

Common Variations and Edge Cases

Tighter phishing controls often increase user friction and operational overhead, so organisations have to balance resilience against the risk of blocking legitimate work. That tradeoff becomes sharper in environments that depend on contractors, shared inboxes, mobile approvals, or cross-border collaboration.

There is no universal standard for every phishing scenario yet. Best practice is evolving toward phishing-resistant authentication, strong identity telemetry, and explicit verification for sensitive actions, but the right mix depends on the threat surface. For example, executive impersonation, payroll diversion, and vendor fraud often require stronger payment verification than ordinary mailbox protection. Meanwhile, in environments with high automation, the biggest risk may be a compromised account triggering downstream workflows rather than a human approving a single login.

Security teams should also avoid overreliance on awareness training as the primary control. Training helps, but it does not neutralise fast-moving lures, brand abuse, or attacks that arrive through trusted channels. The stronger pattern is to combine policy, identity, and transaction controls with continuous monitoring. That aligns with the identity and governance themes in The State of Secrets in AppSec, where exposed secrets and weak operational hygiene extend the life of successful social engineering.

In practice, phishing remains effective wherever a single user action can create a valid session, approve a transaction, or grant durable access before review can occur.

Related resources from NHI Mgmt Group

• Why do cloud security tools still fail when organisations have IAM in place?
• Why does credential phishing still work in organisations with mature email security?
• Why do targeted phishing campaigns still work against mature organisations?
• Why do healthcare organisations remain vulnerable even with email security tools in place?