Topic starter
24/10/2026 8:49 pm
TL;DR: Attackers can move from email to SMS, collaboration apps and voice within minutes, because channel-specific controls do not give defenders the campaign-level view they need, according to Doppel. Correlated detection across infrastructure, identity cues and distribution channels gives teams the context to disrupt the same campaign before it shifts lanes.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “How AI Agents Track Multi-Channel Phishing Attacks”.
Key questions
A: Multi-stage phishing increases risk because each step looks routine in isolation, which lowers suspicion and bypasses controls tuned for a single malicious email.
Q: How can security teams detect Social Engineering Attack?
A: Security teams can detect Social Engineering Attack by watching for unusual requests to reset credentials, change payment details, approve MFA prompts, or bypass process controls.
Q: What breaks when phishing lures are blocked in one channel but attackers pivot elsewhere?
A: What breaks is the assumption that a single control can contain a campaign.
Practitioner guidance
- Correlate campaigns across all inbound channels Link email, SMS, collaboration platforms and voice events to the same campaign record so blocked lures are not treated as isolated incidents.
- Pre-authorise infrastructure takedown actions Define policy thresholds that allow suspension requests for domains, hosting and paid ads when the campaign confidence is high enough.
- Harden executive approval paths Require secondary verification for MFA approvals, payment requests and urgent access approvals that arrive through voice or chat.
Bottom line: Attackers no longer need to win in one channel because they can pivot across email, SMS, collaboration tools and voice until a lure succeeds.
Glossary terms: Campaign Graph, Channel-Siloed Defence, Lookalike Infrastructure, Machine-Speed Takedown
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Channel-siloed social engineering is now a governance failure, not just a detection gap. Once an attacker can shift from email to SMS to collaboration tools and voice in minutes, the control boundary defined by individual point products collapses. Security teams need campaign-level visibility because the adversary is operating across identities, infrastructure and communication channels at once. The practitioner conclusion is that correlation architecture matters more than any single lure filter.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should own takedown decisions when a phishing campaign spans email, ads and collaboration tools?
A: Ownership should sit with a pre-defined cross-functional response path that includes security, legal and the platform owners who can actually remove the infrastructure. The key is pre-delegated authority. If each takedown requires fresh debate, the attacker keeps moving faster than the organisation can coordinate.
👉 Read our full editorial: Agentic social engineering defense moves beyond siloed alerts
This post was modified 7 days ago by NHI Mgmt Group