ConsultationPhishing remains one of the most common initial-access paths. Adversaries use lookalike domains, malicious attachments, and now proxy kits to steal sessions.
Baseline technical controls include SPF, DKIM, DMARC in reject mode, attachment and link filtering, and browser isolation for high-risk roles.
Push-based MFA without number matching is vulnerable to fatigue. Prefer FIDO2/WebAuthn or at least more phishing-resistant methods.
Training must pair with realistic simulation and reporting incentives. Punishment alone drives concealment and worsens MTTD.
For SOC teams, unusual-location login immediately after a phishing click is a classic use case that should be tuned and drilled.
Treat every successful internal phishing campaign as a serious near-miss: document the path, template, and broken control, then fix them.