The phishing phenomenon: Why your spam filter isn’t enough
Relying solely on spam filters to protect your organisation from phishing attacks is unfortunately not enough. Today’s cybercriminals are constantly innovating, and they’re targeting our people as much as our technology.
As phishing attacks become more sophisticated—often powered by AI—we need to think about security as more than just technology; it’s a cultural imperative that involves every employee.”
Phishing remains the most widely used cyber-attack vector, with a staggering 78% of phishing attacks in 2022 using sophisticated techniques to bypass email security tools.
Even more alarming, 56% of these attacks circumvented legacy security filters entirely.
Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 AFRICA, emphasises the gravity of the situation: “The threat of a data breach for companies is genuine. Traditional approaches like secure email gateways alone aren’t enough against well-orchestrated, human-centered attacks.”
Collard’s own experience serves as a cautionary tale. Despite her expertise in cybersecurity, she fell victim to a cleverly disguised phishing email while in transit.
“I was in an Uber, checking my emails as I chatted to the driver,” she recalls. “I saw an email supposedly from Uber asking me to update my account details. It was an incredible coincidence that I was in an Uber at the time, so without hesitating, I clicked on it.”
This incident underscores a crucial point: even the most security-conscious individuals can be caught off guard when distracted or overwhelmed, a state of mind many employees regularly experience.
The human factor: Both vulnerability and strength
Recent studies reveal that at least 14% of employees regularly click on phishing emails, with distractions accounting for 45% of these clicks.
The human element remains a critical weak point in cybersecurity defences, but it can also be a powerful asset when adequately harnessed.
Stephen Osler, co-founder and business development director at Nclose, a provider of cybersecurity services, notes: “Traditional email security measures often focus only on technological solutions, neglecting the crucial human aspect of cybersecurity. While spam filters and secure email gateways play a role, they’re insufficient against modern cybercriminals’ sophisticated social engineering tactics.”
Collard agrees, adding, “If you want to change human behaviour, you cannot rely on training alone. That is where phish testing plays a crucial role.”
However, she cautions against approaches that shame or instil fear in employees who fall for these tests.
“The goal should never be to shame individuals who fail the test, as this can have negative consequences,” she explains.
Instead, Collard advocates for a more empathetic approach. “Are staff feeling stressed and overworked? Are they going through financial difficulty? Knowing this will help organisations understand what’s driving employees’ risky online behaviour.”
Beyond traditional defences: The rise of AI and crowdsourcing
As cyber threats evolve, so too must our defence strategies.
Innovative solutions are emerging that combine the power of artificial intelligence with the collective intelligence of human users—an approach known as crowdsourcing.
“Crowdsourcing enables users to report phishing campaigns faster than conventional methods,” Collard explains. “Imagine tens of thousands of organisations sharing this sort of information. Imagine a blocklist where not just your users’ reported phishing emails end up, but millions from all over the world.”
This global approach to threat intelligence is at the heart of new, sophisticated anti-phishing tools. One such solution is PhishER Plus, developed by KnowBe4.
This lightweight Security Orchestration, Automation and Response (SOAR) product is designed to orchestrate phishing threat response and supercharge an organisation’s email security defences.
PhishER Plus combines robust machine learning-powered email analysis, prioritisation, inoculation, and blocklisting capabilities with a powerful global threat feed for proactive anti-phishing protection.
The system is powered by a triple-validated global threat feed that automatically blocks phishing attacks before they reach users’ inboxes.
“PhishER Plus serves as your phishing emergency room,” says Collard. “It helps your internal or external InfoSec and SOC teams to identify the most dangerous threats more quickly while automating the handling of the 90% of reported emails that are not threats.”
A multi-layered approach to cybersecurity
While innovative tools like PhishER Plus represent a significant advancement in the fight against phishing, they are most effective as part of a comprehensive, multi-layered approach to cybersecurity.
“No single solution can provide complete protection against today’s sophisticated cyber threats,” Osler adds. “Organisations need to implement a combination of technological defences, employee training, and proactive threat intelligence to create a robust security posture.”
Collard concurs, adding, “The future of phishing defence lies in the synergy between AI, human intelligence, and continuous education. By promoting a culture of cybersecurity awareness and using advanced tools, organisations can greatly decrease their risk of falling victim to phishing attacks.”
“As phishing tactics grow more advanced, relying on spam filters alone is no longer enough. Instead, organizations need a holistic, proactive approach to email security that combines the latest technology, human insight, and collective intelligence. When cybersecurity is embraced as a cultural value, employees feel part of something bigger, aligned with a mission to protect each other and the organization. It’s only through this cultural shift that companies can stay ahead of the phishing threat.”
For more information on KnowBe4’s PhishER product or to sign up, click here.
Loading ...
