phishing

A social engineering attack where an attacker impersonates a trusted entity — a bank, employer, or colleague — to trick the recipient into revealing credentials, clicking a malicious link, or transferring funds. Spear phishing targets a specific individual with personalized detail. Business email compromise (BEC) specifically targets financial transactions. Most successful enterprise breaches begin with a phishing email.

When you'd see it: Security awareness training, incident reports, email gateway alerts, employee onboarding.

Why it matters: Technical controls only go so far — phishing attacks human judgment. Security-aware employees who know how to verify unexpected requests are the most effective defense against this attack vector.

Common mistakes: Assuming phishing is easy to spot. Modern spear-phishing uses accurate company context, correct names, and convincing visual styling — it is not always obvious.

Related social engineering, MFA, security posture, incident response