How to Prevent Phishing Attacks: Controls That Work When Training Fails

Your best engineer clicked. Not the new hire, not the person who ignores every security email. The careful one, at 4pm on a Friday, on a message that looked exactly like a shared document notification from a colleague they were already expecting to hear from.

This is the fact that should shape your entire strategy: given enough attempts, somebody always clicks. Awareness training reduces the rate. It does not reach zero, and a defence that requires zero is not a defence. The controls below are ordered by how well they hold when a click has already happened.

Why training alone does not work

Awareness training is worth doing. It is not a control, it is a risk reduction, and the difference matters when you are deciding where to spend.

Attackers now write in fluent, contextually correct English, personalise from public data, and time messages to real events like a funding round or a system migration. The tells people were taught to spot, bad grammar and odd addresses, have largely gone. Meanwhile a phishing campaign only needs one success out of hundreds.

So the design goal is not preventing clicks. It is making a click survivable.

The control that matters most

If you do one thing, make it phishing-resistant multi-factor authentication: hardware security keys or passkeys, on FIDO2 or WebAuthn.

The reason is mechanical rather than a matter of degree. These methods bind the credential to the real domain. When a user lands on a lookalike site and tries to authenticate, the key simply does not produce a valid response, because the origin does not match. There is nothing for the attacker to relay.

That is not true of the MFA most companies run.

Modern phishing kits act as a live proxy: the victim enters credentials and a one-time code on the fake page, the kit passes both to the real service instantly and steals the resulting session. Any code a human can read and retype can be relayed. That is why the distinction in the table is a difference in kind, not in strength.

Start with administrators, finance and anyone who can move money or change access. Full rollout can follow.

The rest of the stack

Email authentication. Publish SPF, DKIM and DMARC, and move DMARC to enforcement rather than leaving it on monitoring forever. This stops attackers spoofing your own domain at your own staff, which is a common and effective pattern.

Filtering that rewrites links. Rewriting lets the gateway check the destination at click time rather than delivery time, which catches pages weaponised after the message arrived.

Flag external mail clearly. A visible banner on messages from outside the organisation is cheap and reliably useful, particularly against display-name impersonation of executives.

Restrict who can act on a request. Most damaging phishing ends in a payment or a credential change. Requiring a second approver for bank detail changes and payments above a threshold removes the payoff, whatever the email said.

Make reporting one click and never punish it. A report button in the mail client, and a culture where reporting a real click gets thanks rather than blame. The hour between click and disclosure is where the damage compounds.

The first hour after a click

Have this written down before you need it, because the useful window is short.

1. Revoke the session, not just the password. Stolen session tokens survive a password reset. Sign the account out everywhere.
2. Reset credentials and re-enrol MFA. Assume the second factor is compromised too.
3. Check for persistence. Attackers add mail forwarding rules, OAuth app grants and inbox filters that hide replies. These outlive a password change and are the step most often skipped.
4. Look for lateral movement. Sent items, new logins from unfamiliar locations, anything the account approved.
5. Tell the people the account emailed. The next victim is usually in that mailbox's contacts.

Tools

The stack is email security at the gateway, identity with phishing-resistant MFA, and detection to catch what gets through. Our comparisons cover email security tools, security awareness training and SIEM platforms for the detection layer.

Buy identity first. It is the control with the highest ratio of attacks stopped to money spent.

Pitfalls

Treating the phishing simulation score as the goal. Optimising for a lower click rate on your own tests teaches people to spot your tests. It does not generalise to a real, well-targeted message.

Leaving DMARC on monitoring. A policy of none observes abuse without preventing it. Plenty of organisations have collected reports for years and stopped nothing.

Rolling out MFA to everyone except administrators. The exception is nearly always made for convenience, and administrators are precisely who the campaign is aimed at.

Forgetting mail forwarding rules in the cleanup. Attackers use them to keep reading after you have locked them out, and nobody checks.

What the software actually costs

There is no single price for security tooling, so the useful reference is what comparable software costs. We price every tool we review: 293 of 429 publish a price, 33% offer a free tier, and the median entry plan across all of them is $24 a month. 169 of them cost under $25, and only 28 cost more than $100.

Category changes that number more than any other factor. The gap between the cheapest and the most expensive category median is $8.13 against $59, a factor of 7.3.

FAQ

Does multi-factor authentication stop phishing?

It stops password reuse and simple credential theft, which is a large share of attacks. It does not stop a real-time relay, where a proxy page collects the code and uses it within seconds. Only phishing-resistant methods, passkeys and hardware security keys, prevent that, because the credential is cryptographically bound to the real domain and will not respond to the fake one.

Is security awareness training worth the money?

Yes, as risk reduction, and no, as a control. It lowers the click rate and, more usefully, raises reporting rates, which shortens the time between compromise and response. What it cannot do is reach zero clicks, so it should never be the layer you rely on. Budget it after phishing-resistant MFA, not before.

How do I know if we have been phished already?

Look for the persistence rather than the click: unexpected mail forwarding rules, unfamiliar OAuth application grants, inbox rules that move replies to a folder, and sign-ins from new locations or devices. Most organisations that discover an old compromise find it through one of those, not through the original message.

What is business email compromise?

A phishing variant that skips malware entirely. The attacker takes over or convincingly imitates a real mailbox, waits, learns the language and the payment process, then requests a transfer or a change of bank details at a plausible moment. It defeats technical controls aimed at attachments and links, which is exactly why the second-approver rule on payments matters more than any filter.