Phishing remains one of the most common ways attackers get into organisations. Messages are now well written, personalised and often arrive through channels other than email.
What Has Changed
- Better writing: spelling mistakes are no longer a reliable warning sign.
- More channels: text messages, messaging apps and collaboration tools are used alongside email.
- Business context: fake invoices, delivery notices and supplier bank detail changes are designed to fit everyday work.
- MFA fatigue: repeated login prompts encourage users to approve one just to make them stop.
What Works in Training
- Short, regular sessions rather than one long annual course.
- Realistic simulations based on messages your staff actually receive.
- A clear reporting route, such as a single button or address, with a quick response.
- No blame. People who report a mistake quickly are an asset.
Controls That Support People
Training works best alongside technical controls: email filtering, domain authentication (SPF, DKIM and DMARC), multifactor authentication and a verification process for any change of bank details.
Want a phishing simulation and awareness session for your team? Get in touch.