Phishing still works because it exploits attention, urgency and trust instead of a software bug, so patching cannot close it. Look for pressure to act now, requests for credentials or payment, mismatched sender or link addresses, and unexpected attachments. Then back people up with controls that still hold after someone clicks.
What is phishing, exactly?
MITRE ATT&CK describes phishing as electronically delivered social engineering used to gain access to victim systems. It can be targeted, called spearphishing, aimed at a specific person, company or industry, or non-targeted, as in mass spam campaigns. Delivery is usually an email with a malicious link or attachment, though the same idea travels by text, direct message and phone call.
CISA's consumer guidance says much the same: messages are often designed to look like they come from a trusted person or organization, to provoke a response. That last part is the whole attack. The goal is a reply, a click, or a login on a page the attacker controls.
Why does it keep working?
Because the attacker needs to be right once, and the defender needs to be right every time. A busy person reading forty messages an hour will, sometimes, act on the forty-first.
Two other factors help the attacker. Sender names are easy to fake, and a convincing message can be built from public information about a company, such as who reports to whom and which vendors it uses. A constructed example: an accounts payable clerk receives a note that looks like it is from a known supplier, with the correct invoice number format and a "new bank details" request. Nothing is technically malicious. The deception is the payload.
What are the warning signs now?
CISA lists common signs: urgent or emotionally charged language, especially claims of dire consequences for not responding immediately; requests for personal or financial information; untrusted shortened URLs; and incorrect addresses or links, such as a lookalike domain with a swapped letter.
The same page makes a point that has changed the advice. Poor grammar and spelling used to be a tell, but in the era of AI some emails now have perfect grammar and spelling, so you should rely on the other signs. Good writing is no longer evidence of legitimacy.
Add one habit to those: check the channel. A request that changes how money moves or how access is granted should be confirmed through a different, already known route, such as a phone number from your records.
What controls survive a click?
The CISA, NSA, FBI and MS-ISAC guide titled Stopping the Attack Cycle at Phase One covers phishing techniques and offers recommendations for network defenders and for software manufacturers. A theme is reducing the damage of a single mistake, not demanding perfection.
Practical measures in that spirit include phishing-resistant multi-factor authentication, which does not hand a reusable code to a fake page; email authentication records so spoofing your own domain is harder; blocking or sandboxing risky attachments; least-privilege accounts so a stolen login reaches less; and an easy way to report a suspicious message.
Reporting deserves attention. A culture where people report quickly, and nobody is shamed, turns individual clicks into early warning for everyone else.
How to check or apply this
- Before acting on a message, ask what it wants you to do and whether it is urgent for a believable reason.
- Hover over links and read the real domain. Type known addresses yourself instead of following a link.
- Treat changes to payment details or access as requiring confirmation by a separate channel.
- Turn on phishing-resistant MFA for email, identity and administrator accounts first.
- Make reporting a single click or a single address, and acknowledge each report.
- Run simulations only if you pair them with teaching and never punish clicks.
- Review what a compromised mailbox could reach, and cut that down.
Where does Safeguard fit?
Phishing is mostly an email and identity problem, and Safeguard is not an email security product. Its relevant role is in the software you build: scanning repositories for committed secrets and checking that your own apps do not make credential theft easier.
Quick check
Does good spelling mean an email is safe?
No. CISA notes that AI-assisted messages can have perfect grammar. Judge by urgency, requests, sender and link addresses, and whether the channel makes sense.
What is the difference between phishing and spearphishing?
Phishing is the broad category of social engineering by message. Spearphishing is targeted at a specific person, company or industry, using details that make it believable.
Sources
- MITRE ATT&CK T1566, Phishing
- CISA, Recognize and Report Phishing (archived content)
- CISA, Phishing Guidance: Stopping the Attack Cycle at Phase One
Last reviewed: 18 October 2026.
