Skip to content

The Layers That Stop a Phishing Click From Becoming a Crisis

Most discussions on phishing focus on prevention, but an important conversation that is often missed is about what happens in the minutes after prevention fails. The reality is that because many organizations experience phishing attempts at volume, there is a likelihood that one will get through.

Cybersecurity awareness training and advanced email solutions are common tools used to prevent successful phishing attempts, but it is impossible to mitigate all risk when the human element, employees, is what’s being exploited by threat actors. A firm that does yearly cybersecurity awareness training and quarterly phishing tests may still have a member of staff open a convincing phishing email and click a malicious link. When the employee realizes their mistake or begins to notice suspicious activity, like their machine running slower, unauthorized password resets, or unexpected MFA prompts, a process has to be in place to quickly contain and remediate the threat.

With the proper controls and processes in place, incidents should stay small and be a support ticket rather than escalate to business interruption. Decisions an organization makes months earlier, none of which are urgent at the time, make the difference when a threat actor comes knocking.

Why Phishing Volume Can Be the Underlying Problem

Today, organizations are receiving a persistent flow of phishing attempts at a higher volume than ever, rather than the occasional suspicious message. Generative AI and automation allow hyper-personalized error-free emails in multiple languages to be generated at massive scale and speed. Affordable “Phishing as a Service” criminal tool kits are available for purchase, lowering the technical barrier to entry for threat actors. And phishing is not just coming through the traditional channel of email. Smishing, or SMS text phishing, and vishing, or AI-driven deepfake voice calls, are becoming more prevalent. Finally, new harder-to-scan alternative channels are being used to try to bypass preventive measures, including:

  • Quishing, or QR codes that lead to malicious links, embedded in images to bypass text-based email filters
  • Fake security checks, like CAPTCHA-Gated and PDF redirects to hide landing pages from scanners
  • Adversary-in-the-Middle tools that intercept login credentials and MFA sessions

Attackers select targets based on what the employee on the other side of an inbox or phone can reach, and any organization that holds sensitive data, like patient PHI, moves money, or serves clients who do both is worth a sustained campaign from a threat actor.

Building a Multi-Layered Approach to Combat Phishing

Many cybersecurity best practices are built on the assumption that controls may fail – there may be a Zero Day, there may be a human-element creating uncontrollable factors, there may be a misconfiguration, the list goes on. This is why layers of tools, alerts, and processes are built into a security program to ensure there are several levels of defense in place to detect and contain any malicious activity.

One layer is the technical email protections. Email security tools use several methods to detect phishing attempts and filter out spam. This includes:

  • Sender authentication to confirm the email truly comes from the claimed domain
  • Reputation and blocklist checks that compare the sender’s IP address and domains in addition to embedded links against a database of known malicious sources
  • Header filters that inspect hidden email metadata to identify obfuscated or modified information
  • Custom filters built for an organization based on their needs to block specific senders or keywords
  • AI-enabled filtering for enhanced content, header, and network analysis

These tools also have simple reporting tools, like a “report phishing” button directly in employee email clients so staff can instantly flag suspicious messages. The best security teams work with an organization to calibrate filters so unusual-looking traffic that may actually be routine for a client comes through.

Another layer is access controls and authentication. Multi-Factor Authentication (MFA) needs to be required across all accounts. A Zero Trust Model should be used to verify identities continuously. Enterprise password managers can be used to encourage strong and unique passwords, enforce standardized password rules, and create a process for safe credential sharing.

Next, security has to be embedded into employee culture. Regular trainings and phishing tests keep employees aware of the latest scams and on the lookout for malicious emails, texts, or phone calls. They also teach and reinforce the proper process for reporting suspicious activity.

If all other controls fail, the right processes have to be in place for containing and eradicating any attempts that slip past. A sufficiently well-constructed phishing email will reach an inbox eventually, so the relevant question is not whether one arrives, but what the organization does afterward. For example, verification controls that require multi-person sign-offs and verified callbacks on a known number can stop fake wire transfers or false MFA resets.

Finally, Managed Detection and Response, or MDR, combines automated alerting with 24x7x365 human-led threat monitoring, hunting, and rapid containment. Integrated with an organization’s environment, if an employee falls for a phish and clicks a malicious link, it catches unauthorized activity like executions, abnormal process launches, or credential harvesting attempts in real-time.

The Difference Is Not Just the Tooling

Any organization can purchase security tools, but the real difference is the processes and people behind them. Ensuring proper configuration and creating a human escalation point when tools fail is what rounds out a security program.

Whether it is an on-site IT team, a managed provider, or a combination of both, an established channel with a team on the other end who already understands the environment and who has a process to follow is key.

Work with a Team You Can Trust

Abacus supports organizations in highly regulated industries, like financial services and healthcare, and builds their security program with foundational controls, like email security, cybersecurity awareness training, and MDR through our AbacusFlex (Finance) and mCare (Healthcare) platforms. Our 24x7x365 team includes more than 100 cybersecurity experts ready to help our clients contain and eradicate threats. To learn more, get in touch with our team.