They work because they exploit trust, urgency, and routine behaviour. A malicious message can persuade a user to click a link, open an attachment, or disclose credentials before the victim notices the deception. Spear phishing is more dangerous because it targets specific people and impersonates trusted entities, which increases credibility and makes the attack harder to spot.
Why phishing still works on business users who know the basics
Phishing remains effective because business users operate in fast-moving, message-heavy environments where inbox decisions are often made under time pressure. Attackers do not need perfect deception; they only need a small moment of misplaced trust. The most successful lures imitate routine business activity such as invoice handling, password prompts, document sharing, courier notices, or executive requests, so the message feels operational rather than suspicious. NIST’s control guidance on access control, awareness, and incident response shows why this is a durable problem: humans remain part of the trust boundary even when technical controls are strong. NIST SP 800-53 Rev 5 Security and Privacy Controls
In practice, many security teams encounter phishing as a business-process failure first and a security failure second, because the message is usually crafted to fit an existing workflow rather than to look overtly malicious.
How phishing and spear phishing gain traction in real workflows
Phishing succeeds when the message aligns with the recipient’s normal task flow. A user may be managing payroll, procurement, travel, HR, or customer communication, and the attacker’s payload only has to interrupt that routine long enough to trigger a click, reply, approval, or credential entry. spear phishing increases that success rate by using details that appear specific and believable, such as internal roles, recent business activity, or names of known services. The more the message resembles a legitimate work request, the less cognitive effort the target spends verifying it.
The practical weakness is not just gullibility. It is the combination of attention scarcity, delegated authority, and overfamiliarity with internal processes. People are trained to respond quickly, especially when the email appears to come from a manager, a supplier, or a platform they already use. That is why phishing often bypasses user suspicion before security tooling can intervene, especially when the sender domain, branding, or language is close enough to the real thing.
- Generic phishing scales by volume and relies on broad psychological triggers.
- Spear phishing trades scale for credibility by tailoring the lure to one person or team.
- Both often exploit business urgency, payment pressure, document sharing, or account recovery workflows.
- Both become more effective when the target is distracted, mobile, or responding outside normal approval channels.
Where organisations underinvest in verification habits, phishing becomes a process shortcut that users take before they consciously evaluate the request, and that is where the guidance begins to break down.
Where the usual advice breaks down, and what practitioners should watch for
Tighter awareness training often increases friction, requiring organisations to balance user speed against verification discipline. The common failure case is not ignorance of warning signs, but normalisation of routine-looking malicious requests that fit existing work patterns.
There is a genuine consensus that no single safeguard stops phishing by itself, but there is less consensus on how much friction users will tolerate before they bypass controls. In higher-pressure environments, the weakest point is often approval workflows that rely on email alone, because a convincing message can push a user to act outside the intended process. Spear phishing also becomes more effective when attackers combine multiple hints of legitimacy, such as correct names, plausible timing, and an expected document or business context.
Practitioners should treat any email-driven action that creates account access, payment movement, or privileged approval as a higher-risk decision point than ordinary correspondence. The question is not whether users are aware that phishing exists, but whether the organisation has made it easy to verify before acting. In many environments, the true weakness is not the message itself but the absence of a strong second-channel check when the request matters most.
Practitioner takeaway: The best defence is not to assume users will reliably spot deception, but to remove single-email authority from the most sensitive actions and make verification the default path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 14 — Security Awareness and Skills Training | Phishing exploits user trust and routine, making awareness and simulation directly relevant. |
| Recommendation — Train users to recognise and verify suspicious requests before they act. | ||
| NIST CSF 2.0 | PR.AT-1 — PR.AT-1: All users are informed and trained | User awareness is central because phishing targets routine human decision-making. |
| PR.AC-4 — PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties | Phishing becomes more damaging when a captured user can approve or access too much. | |
| DE.CM-8 — DE.CM-8: Vulnerability scans are performed | Spear phishing often relies on exposed services, identities, or patterns that monitoring can surface. | |
| Recommendation — Keep all users trained on phishing cues and reporting expectations. Limit user permissions so a compromised mailbox yields less reach. Monitor for exposed identity and communication weaknesses that aid targeting. | ||
| MITRE ATT&CK | T1566 — Phishing | The question directly concerns phishing as the primary adversary technique. |
| Recommendation — Map phishing attempts to T1566 and tune detections for lure delivery and user interaction. | ||
Related resources from NHI Mgmt Group
- Why do phishing and social engineering remain so effective against Web3 organisations?
- Why do phishing and fake identities remain so effective against crypto companies?
- Why do AiTM phishing attacks remain effective against SSO environments?
- Why do maintainer phishing attacks remain so effective against software ecosystems?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
