Topic starter
01/08/2026 8:58 pm
TL;DR: Spear phishing remains a top initial access path because most organisations still lack an effective defence-in-depth strategy, leaving business email compromise, session hijacking and ransomware exposure, according to Knowbe4. The real failure is not awareness training alone, but weak identity and session controls that let stolen trust become usable access.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “eBook: Comprehensive Anti-Phishing Guide”.
Key questions
Q: What breaks when phishing controls stop at user awareness alone?
A: Awareness without identity enforcement leaves the attacker free to reuse stolen credentials, hijack sessions, or pivot through recovery workflows.
Q: Why do stolen credentials and session tokens undermine zero trust programmes?
A: Zero trust assumes trust is continuously verified, but stolen credentials and session tokens let an attacker impersonate a legitimate user after the initial check.
Q: What are the signs that phishing-resistant controls are not being applied effectively?
A: A common warning sign is that users still authenticate with passwords, SMS codes, or push approvals for sensitive access while rare device registrations and unusual login events are not being reviewed.
Practitioner guidance
- Implement phishing-resistant step-up for high-risk actions Require stronger verification for mailbox forwarding changes, payment approvals, and privileged requests so a stolen session cannot freely perform sensitive actions.
- Harden session governance and token handling Shorten session lifetime, bind sessions to device or risk context where possible, and monitor for impossible travel, token replay, and abnormal delegation.
- Limit the blast radius of delegated email access Review mailbox delegation, auto-forwarding, and shared inbox permissions so phishing in one account does not create broad communication control.
Bottom line: Phishing defence fails most often when organisations assume user awareness is sufficient and do not govern the identity trust that follows a successful phish.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:05 pm
Phishing defence fails when organisations overestimate awareness and underestimate identity trust. User vigilance is necessary, but it does not stop a stolen token, a reused session, or a consent flow that hands an attacker usable access. The real governance gap is that many security models still treat successful login as proof of trustworthy intent. Practitioners should design for post-phish control loss, not just phishing prevention.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should teams balance awareness training with technical controls for phishing?
A: Training should remain part of the programme, but it should not carry the full burden of prevention. Teams should combine awareness with phishing-resistant authentication, tight session controls, least privilege, and rapid revocation so one mistake does not become a breach path. Human judgement is fallible, so the control stack has to absorb that reality.
👉 Read our full editorial: Phishing defence still fails where identity trust is weakest