Phishing
Phishing tricks people into handing over data or access. Here is how it works and why it remains the top cause of breaches.
What Is Phishing?
Phishing is a type of cyberattack in which criminals impersonate a trusted person or organization to trick victims into revealing sensitive information, clicking malicious links, or transferring money. It is the most common and effective form of social engineering.
How It Works
A phishing attack typically arrives as an email, text, or message that appears to come from a legitimate source, such as a bank, a vendor, or a colleague. The message creates urgency or trust, prompting the victim to act quickly. It might ask them to log in through a fake website, open a malicious attachment, or reset a password on a spoofed page.
Once the victim takes the bait, the attacker captures their credentials, installs malware, or convinces them to send funds. Phishing has many variants, including spear phishing that targets specific individuals, and it succeeds by exploiting human trust rather than technical flaws. That focus on people is exactly what makes it so hard to stop with technology alone.
Why It Matters
Phishing is the leading entry point for cyberattacks, involved in the majority of data breaches. It bypasses even strong technical defenses by targeting the one element no firewall protects: your people. A single employee clicking one convincing link can hand an attacker the keys to your entire organization.
Because phishing exploits human behavior, defending against it requires more than software. Regular security awareness training, combined with tools like email filtering and multi-factor authentication, is the most effective defense. For any organization, teaching staff to recognize phishing is one of the highest-value security investments available.
Related Terms
Years Protecting Businesses
BAA Coverage on Healthcare Engagements