Why do phishing attacks still lead to major breaches when email filters are in place?

Why This Matters for Security Teams

Email filtering reduces commodity spam, malware, and some known-bad links, but it does not eliminate the core phishing problem: a person being persuaded to hand over a credential, approve a prompt, or trust a fake workflow. Once the attacker has a valid login or session token, the issue stops being an email problem and becomes an identity and access problem. NIST control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that detection and prevention need to be paired with access restrictions, monitoring, and response.

Security teams often overestimate the value of delivery-layer controls and underestimate how quickly attackers pivot after a single successful interaction. Modern phishing is less about spraying obvious spam and more about convincing the target to complete an authentication step, verify a login, or reuse a password on a lookalike site. That makes credential theft, MFA fatigue, and session hijacking central failure modes rather than edge cases. The practical lesson is that inbox defense is necessary but not sufficient, especially where the business depends on remote access, SaaS, and delegated admin tools. In practice, many security teams encounter the breach only after valid accounts are already being used, rather than through intentional detection of the phishing lure.

How It Works in Practice

A phishing attack typically succeeds in stages. First, the message reaches the user through email, collaboration tools, SMS, or a browser-based workflow. Second, the lure creates urgency or trust, such as a document share, invoice, password reset, or cloud login request. Third, the attacker captures something useful: a password, MFA code, push approval, recovery token, or authenticated session. From there, the attacker may move laterally, harvest more secrets, or use the account to send additional lures.

That is why the control stack has to extend beyond mail filtering into identity, endpoint, and response layers. Detection logic should look for impossible travel, new device enrolment, risky OAuth consent, mailbox rule changes, and anomalous session behaviour. Threat patterns such as MITRE ATT&CK Enterprise Matrix techniques help teams map what happens after initial access, not just how the message arrived. For organisations seeing phishing paired with automated abuse, CISA cyber threat advisories are useful for tracking current tradecraft and response priorities.

• Require phishing-resistant MFA for privileged and high-risk users where feasible.
• Block legacy authentication and limit password reset pathways that bypass stronger checks.
• Monitor for session token abuse, inbox rules, and suspicious consent grants.
• Use least privilege so a stolen account cannot reach everything.
• Combine email telemetry with SIEM and identity logs for faster correlation.

Where organisations are experimenting with autonomous abuse, the threat may also involve AI-assisted lure generation or post-compromise automation, which is why current guidance increasingly considers AI-enabled tradecraft alongside traditional phishing patterns. These controls tend to break down in heavily federated SaaS environments because inconsistent identity logging and fragmented session visibility make compromise hard to confirm quickly.

Common Variations and Edge Cases

Tighter email and identity controls often increase friction for users and support teams, requiring organisations to balance stronger protection against operational overhead. That tradeoff is especially visible where executives, finance teams, and administrators need rapid access but are also high-value phishing targets.

There is no universal standard for every phishing scenario, but several edge cases recur. SMS phishing and callback scams bypass mail gateways entirely. OAuth consent phishing can succeed even when no password is entered, because the attacker abuses application permissions rather than direct credential theft. MFA fatigue attacks rely on repeated prompts until a user approves by mistake. Help desk social engineering can also defeat otherwise strong email security by resetting access through a human process.

Where AI-generated content is involved, the line between bulk phishing and targeted social engineering is getting blurrier. Current guidance suggests treating AI-orchestrated campaigns as an acceleration of familiar techniques, not a wholly new category of attack. Research such as the Anthropic first AI-orchestrated cyber espionage campaign report and the MITRE ATLAS adversarial AI threat matrix show why defenders should watch for AI-assisted reconnaissance, message tailoring, and automation after first contact. The practical boundary is clear: when the user interaction produces authenticated access, email filtering has already done all it can.

Related resources from NHI Mgmt Group

• Why do phishing and MFA fatigue still lead to major breaches?
• Why do weak MFA deployments still lead to major breaches?
• Why do legacy email filters miss modern phishing attacks?
• Why do phishing-resistant methods still fail against man-in-the-middle attacks?