Topic starter
12/07/2026 12:22 pm
TL;DR: Phishing remains a primary initial access path for ransomware and account theft, according to Zero Networks, because attackers now combine email, SMS, QR codes, voice and AI-generated lures to bypass human judgment and point defenses. The control problem is shifting from awareness alone to layered containment that limits credential abuse and lateral movement.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “What Is Phishing? Everything You Need to Know”.
By the numbers:
- Social engineering attacks account for nearly a quarter of external security breaches, and 57% of those incidents involve phishing.
Key questions
Q: What breaks when phishing controls stop at user awareness alone?
A: Awareness without identity enforcement leaves the attacker free to reuse stolen credentials, hijack sessions, or pivot through recovery workflows.
Q: Why do QR-code and AI-assisted lures increase account takeover risk?
A: QR codes hide the destination until scanned, and AI lowers the effort needed to produce convincing impersonation across text, voice, and video.
Q: What are the signs that phishing reporting is failing as a control?
A: The clearest signs are high report volume with little reduction in compromise risk, no visibility into who was targeted, and the same users repeatedly generating alerts without follow-up action.
Practitioner guidance
- Harden MFA against phishing resistance gaps Move beyond SMS and push-only MFA for privileged and sensitive access, and require phishing-resistant authentication where possible.
- Contain credential abuse with microsegmentation Isolate high-value assets so a stolen credential cannot move laterally from a user workstation into administrative or sensitive environments.
- Add out-of-band verification for QR and voice lures Require a separate verification path for requests that arrive via QR code, phone, or messaging app before any credential reset or payment change.
Bottom line: Phishing remains effective because it exploits both human trust and identity systems that still accept stolen credentials as valid access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:36 pm
Phishing is now an identity governance problem, not just a user education problem. The article shows that the real failure is not simply that users click, but that environments still allow stolen credentials to remain useful after the click. IAM and PAM controls have to assume the lure will succeed at least once, then stop that success from turning into durable access.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should teams balance user training with technical containment?
A: Training remains useful, but it should not be the primary control in a phishing programme. Teams should pair it with phishing-resistant authentication, strict access scope, and network isolation so that one mistaken click does not become enterprise compromise. The best result is fewer successful lures and a much smaller blast radius when one lands.
👉 Read our full editorial: Phishing is still the main doorway for ransomware and account theft