Phishing Awareness
Defensive view: phishing. Authorised engagements only. The focus is on training, controls, and detection that actually reduce risk.
Defender-first overview
EXAMPLE
# Phishing - defender perspective > Lab and authorised engagements only. This page describes phishing patterns > so defenders can build training, process controls, and detection rules. > Live phishing simulations require signed Rules of Engagement (RoE), legal > review, communication with HR, and scoped consent. No real customer data > appears in examples. ## What modern phishing actually looks like - Vendor invoice change requests (pretexted urgency) - HR-themed payloads (open enrollment, W-2, payroll) - M365/Google login lookalikes - now built with AiTM proxy frameworks - OAuth consent phishing - the user grants an app, no password leaves - Quishing: QR codes in emails or printed posters - Vishing: phone follow-up to confirm a phish - Smishing: SMS targeting MFA approval fatigue ## Controls that defeat the human bypass - DMARC at p=reject after a tuning period (with SPF and DKIM aligned) - MFA on every account - prefer phishing-resistant factors (FIDO2, passkeys) - Conditional access: block unknown geos, require compliant device for sensitive apps - Disable legacy auth (IMAP/POP basic auth, app passwords) - Restrict OAuth consent: admin approval for risky scopes (Mail.ReadWrite, Files.ReadWrite.All) - Inbound mail filtering tuned for impersonation (display-name spoofing, lookalike domains, reply-to mismatch) - Banner external email and known-impersonation domains - Out-of-band verification on financial or vendor changes ## Detection signals - Sign-ins from new geos within minutes of a delivered URL click - Tokens minted via AiTM-style proxies (anomalous user-agent + impossible travel) - New inbox rules: 'move to RSS Feeds', forward to external, mark as read - Sudden spike in 'safe links' clicks on a templated URL - Multiple users reporting the same subject/body (training reporting paying off) - OAuth consent grants to new third-party apps ## Awareness training that works - Realistic scenarios drawn from your industry (vendor invoice, HR, payroll) - Stop training on grammar mistakes; modern phishing is clean - Reward reporting publicly; never punish clicks - Track report-rate and time-to-report, not just click-rate - Brief HR + finance separately on CEO-impersonation patterns - Pair simulations with a same-day debrief ## Engagement reporting - What worked, what did not, who reported (anonymised by role) - Tie findings to specific controls (DMARC, conditional access, OAuth governance) - Recommend measurable improvements (raise report rate, lower median time-to-report) - Confirm decommissioned infrastructure and rotated test credentials
Why it matters
Phishing is rarely a technology problem alone. DMARC + MFA + conditional access close most doors; reporting culture closes the rest. The blue-team value of a simulation is the controls and training it justifies - not the click rate.
Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.
Example
Example
# Phishing exercises: pre-agreed pretexts, pre-agreed time windows, # safety-rails (no malware on real user devices), and immediate just-in-time training # when someone clicks. The metric is "did we improve?", not "who failed?".Try it Yourself »
Discussion
Loading…