Topic starter
21/10/2026 7:00 pm
TL;DR: Phishing now works by exploiting trusted workflows and AI-assisted impersonation across email, chat, phone, QR codes and video, according to ThreatLocker. Controls need to limit what a stolen trust event can reach before one click, call or approval becomes a compromise.
Editorial analysis by NHI Mgmt Group, based on content published by ThreatLocker: “How to efficiently spot and prevent phishing attacks”.
By the numbers:
- IBM’s 2026 Cost of a Data Breach Report found phishing accounted for 15% of attacks in studied breaches.
- IBM’s 2026 Cost of a Data Breach Report put the average breach cost linked to phishing at $4.9 million.
Key questions
Q: Why do phishing attacks still lead to major breaches when email filters are in place?
A: Email filters reduce exposure, but they do not stop a convincing lure that reaches a human and captures credentials or MFA approvals.
Q: What are the signs that phishing reporting is failing as a control?
A: The clearest signs are high report volume with little reduction in compromise risk, no visibility into who was targeted, and the same users repeatedly generating alerts without follow-up action.
Q: What breaks when help desk processes rely on MFA alone against social engineering attacks?
A: MFA alone breaks when attackers can socially engineer support staff, reuse stolen credentials, or trigger push fatigue to obtain a valid session.
Practitioner guidance
- Harden support and recovery workflows Require stronger verification for MFA resets, push approvals, and account recovery than the standard login path.
- Apply deny-by-default to endpoints and devices Block untrusted software and restrict device access so a successful phish does not automatically translate into usable execution or privileged connectivity.
- Extend phishing controls beyond email Treat SMS, QR codes, search, collaboration tools, and video calls as part of the phishing control surface.
Bottom line: Phishing remains effective because it now exploits trusted workflows, not just obvious malicious emails.
Glossary terms: Business email compromise, MFA Fatigue Attack, Vishing, Zero Trust Access Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
23/10/2026 12:48 am
Phishing is now an identity attack, not just a messaging problem. The article shows that the real target is trust in who is asking, not just what is being sent. That shifts the governance question from email hygiene to how identity is verified across support, collaboration, and payment workflows. Practitioners should treat phishing as a control failure in trust validation, not only user awareness.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: How can organisations reduce the impact of a successful phishing click?
A: Use layered controls that limit what a stolen credential can do. MFA, conditional access, device trust, DNS filtering, and secure email protection should work together so one click does not become persistent access. The goal is to contain the event at authentication and session level, before it becomes an identity breach.
👉 Read our full editorial: Phishing now blends into normal work and bypasses old cues
This post was modified 4 days ago by NHI Mgmt Group