Phishing now looks normal: what controls actually reduce risk?

TL;DR: Phishing has shifted from obvious scam emails to AI-assisted impersonation across email, chat, phone, QR codes, and video, according to ThreatLocker, with IBM’s 2026 Cost of a Data Breach Report citing phishing as the most common initial attack vector in studied breaches at 15% and an average cost of $4.9 million. The control problem is no longer spotting fake messages, but limiting what stolen trust can do once a user clicks, approves, or replies.

Editorial analysis by NHI Mgmt Group, based on content published by ThreatLocker: “How to efficiently spot and prevent phishing attacks”.

By the numbers:

• IBM’s 2026 Cost of a Data Breach Report found phishing accounted for 15% of attacks in studied breaches.
• IBM’s 2026 Cost of a Data Breach Report put the average breach cost linked to phishing at $4.9 million.

Key questions

Q: What breaks when help desk processes rely on MFA alone against social engineering attacks?

A: MFA alone breaks when attackers can socially engineer support staff, reuse stolen credentials, or trigger push fatigue to obtain a valid session.

Q: Why do phishing attacks still lead to major breaches when email filters are in place?

A: Email filters reduce exposure, but they do not stop a convincing lure that reaches a human and captures credentials or MFA approvals.

Q: What are the signs that phishing reporting is failing as a control?

A: The clearest signs are high report volume with little reduction in compromise risk, no visibility into who was targeted, and the same users repeatedly generating alerts without follow-up action.

Practitioner guidance

• Harden support and recovery workflows Require stronger verification for MFA resets, push approvals, and account recovery than the standard login path.
• Apply deny-by-default to endpoints and devices Block untrusted software and restrict device access so a successful phish does not automatically translate into usable execution or privileged connectivity.
• Extend phishing controls beyond email Treat SMS, QR codes, search, collaboration tools, and video calls as part of the phishing control surface.

Bottom line: Phishing remains effective because it now exploits trusted workflows, not just obvious malicious emails.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →