Every business we take on has an email filter, and every one of them still gets phishing. Both are true, and neither means the filter is bad. The economics of the attack explain it, and once you see that, you spend your effort somewhere more useful.
Filters are good at yesterday's attack
A filter works mostly by recognition. It knows senders and links it has already seen misbehave across millions of other mailboxes. Bulk phishing, the kind sent to everyone, gets caught at very high rates, because by the time it reaches you it has already shown up somewhere else.
The messages that get through are the ones built not to be recognized. A domain registered this week has no reputation to check, and a note written for your company, naming a real vendor or a real project, matches no pattern. An attacker who has already read a compromised mailbox can reply inside a real thread, from a real account, at the moment an invoice is expected.
No filter setting stops that last one, because nothing about the message is technically wrong. The sender is real and the thread is real. Only the bank account number is new.
What happens after a phishing email is delivered
Some phishing will reach inboxes no matter what. The measure of your defenses is what happens next, and I'd ask four things:
- Does the person who gets it notice something is off?
- Do they have a fast, blame-free way to report it?
- Does the report reach someone who can check whether nineteen colleagues got the same message?
- If someone clicked, is there anything limiting what the attacker gets?
That last point is where the technical work pays off. Multi-factor authentication, where a login needs a second step beyond the password, means a stolen password isn't enough on its own. Limited permissions mean one compromised account doesn't open everything. Both are ordinary settings in most business email platforms, and I've lost count of the businesses that have them only half applied.
Reporting is a culture question
Annual security awareness training has its place. But in my experience the businesses that handle phishing well have something simpler: staff who report odd messages without worrying about looking foolish, and someone who actually answers those reports.
The failure I see most is silence. Someone clicks, realizes a minute later, and says nothing out of embarrassment. The attacker gets a week in the mailbox instead of ten minutes. A team that hears thank you when they report, including when they report their own mistake, takes that week back.
What I'd check this week
Here is the order I'd work through it:
- Confirm multi-factor authentication is on for every mailbox, with no exception for executives. Attackers read org charts too, and the exceptions are the accounts they want most.
- Ask how one of your staff would report a suspicious email today, and what would happen to that report. If the answer is a shrug, that's the gap.
- Check that the external sender warning is on, so a message from outside posing as your president is at least labeled.
- Look at what your filter quarantined this month. It tells you what is being aimed at you.
None of this needs new spending. Most of it is configuration and habit.
Where we fit
Our cybersecurity services cover the technical half of this, starting with the authentication setup and the permissions that limit the damage of one bad click. We also check for the forwarding rules attackers quietly plant in a compromised mailbox. The other half, a culture where reporting is fast and normal, we help build but can't buy for you.
If you want an honest read on where your email defenses actually stand, schedule a call. Bring a phishing email that made it through. There's nearly always one close to hand.