Topic starter
12/07/2026 12:15 pm
TL;DR: Phishing remains a major enterprise threat because attackers exploit sender identity cues, urgency, and hidden links, and the article argues that user education, digital signatures, and basic verification steps reduce risk, according to GlobalSign. The control gap is not awareness alone but consistently checking identity and destination before action.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Termine con Phishing. Consejos para identificar emails maliciosos”.
Key questions
Q: What breaks when users trust the sender name instead of the real email address?
A: Display names are easy to spoof, so trust based on the visible name alone breaks down fast.
Q: Why do phishing emails succeed even when the content looks legitimate?
A: Phishing works because it exploits human attention, trust, and urgency.
Q: What should organisations measure to know if email controls are actually working?
A: Organisations should measure detection fidelity, containment speed, and whether suspicious messages lead to fewer successful impersonation or credential theft events.
Practitioner guidance
- Require real-domain verification for unfamiliar senders Teach users to inspect the actual email address and domain, not the display name, before they trust a message or act on it.
- Make destination checks mandatory for every link click Standardise hover or preview checks so users confirm the real URL before opening any embedded link, especially when the message creates urgency.
- Use digitally signed email for trusted business communications Adopt signed mail for messages where sender authenticity materially affects approvals, attachments, or financial action.
Bottom line: Phishing remains effective because attackers weaponise trust cues such as sender names, urgency, and familiar brand language, which can look legitimate long before a user checks the underlying identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:29 pm
Phishing is still a trust-governance problem, not just a user-awareness problem. The article is strongest when it shows that display names, familiar brands, and urgent language are all identity cues attackers can counterfeit. In governance terms, organisations fail when they treat inbox recognition as a security control instead of a signal that still needs verification. Practitioners should move from awareness-only messaging to enforceable authenticity checks.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should teams rely on user training or digital signatures to reduce phishing risk?
A: They need both, but they solve different problems. Training helps users recognise suspicious patterns and pause before acting, while digital signatures provide cryptographic proof that a trusted sender really sent the message. Training alone is fragile; signatures alone do not stop every malicious message, but they materially improve trust decisions.
👉 Read our full editorial: Phishing detection still depends on sender trust and link checks