Notifications
Clear all
Topic starter
12/06/2026 12:20 am
TL;DR: Modern phishing now spans targeting, delivery, camouflage, anti-analysis, MFA bypass, and account takeover, with initial access driven entirely by identity-based techniques and increasingly shaped by cloud-native tradecraft, according to Push Security. The practical lesson is that detection and auth controls must be evaluated as a single attack surface, not separate layers.
NHIMG editorial — based on content published by Push Security: modern phishing detection evasion techniques and the phishing matrix
By the numbers:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
Questions worth separating out
Q: How should security teams defend against modern phishing that bypasses MFA?
A: Defence has to move beyond password and inbox protection.
Q: Why do modern phishing campaigns still succeed even with strong IAM controls?
A: Because attackers are no longer targeting only login pages.
Q: What do organisations get wrong about phishing detection?
A: They often measure success by whether a suspicious message is blocked, when the more important question is whether the attack can still reach a valid session or account.
Practitioner guidance
- Map phishing controls to attack phases Align detection, browser hardening, email controls, identity policy, and SaaS monitoring to the eight-phase model so coverage gaps are visible at each stage.
- Test MFA bypass paths explicitly Run red-team or purple-team exercises against AitM relays, backup-factor downgrade paths, and consent phishing so authentication assumptions are validated against real attack behaviour.
- Review direct SaaS access paths Inventory business apps that can be phished without going through the IdP, then tighten session governance, delegated consent, and app-specific access controls.
What's in the full article
Push Security's full post covers the operational detail this analysis intentionally leaves for the source:
- The full phase-by-phase phishing detection evasion matrix with the specific attacker objectives behind each stage.
- Examples of modern AitM, anti-analysis, and page obfuscation techniques used to evade common detection layers.
- Discussion of delivery channels such as malvertising, Slack, Teams, LinkedIn Messenger, and Reddit that bypass email-only thinking.
- The whitepaper and GitHub resource context for teams that want to extend the matrix internally.
👉 Read Push Security's analysis of phishing detection evasion techniques →
Phishing detection evasion techniques: what IAM teams are missing?
Explore further
12/06/2026 9:31 am
Phishing is now an identity governance problem, not a mailbox problem. The article shows that the attack surface has moved from message filtering to the full path between lure, session, and account takeover. That means identity, email, browser, and SaaS controls have to be assessed as one chain of trust, not as separate products. Practitioners should stop judging phishing resilience by inbox hit rates alone and measure whether identity controls still hold after delivery succeeds.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite.
A question worth separating out:
Q: How do security teams prioritise phishing controls across email, identity, and SaaS?
A: Prioritise the controls that stop an attacker from converting delivery into authenticated access. That usually means tightening authentication policy, limiting risky consent paths, reducing direct app exposure, and correlating signals across email, browser, IdP, and SaaS. The right question is where the chain still becomes usable, not which layer is most visible.
👉 Read our full editorial: Phishing detection evasion now hinges on identity controls
