Home / Knowledge hub / Phishing
Knowledge hub
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
What it means
Phishing persuades a person to hand over credentials, approve a payment or install something, by pretending to be somebody they trust. An email from the finance system, a message from the chief executive, a sign-in page that looks exactly right.
The targeted version is the one that works. An attacker reads your website, your team's public profiles and last quarter's announcement. Then they write a message that fits a real situation, addressed to the person who would normally receive it.
Why it matters
It aims at people rather than code, so no amount of careful development closes it. Your application can be spotless and an attacker still signs in as your finance manager, because somebody handed over the password and the code that followed it.
It begins a large share of real incidents. Stolen credentials get used the same day, and because they are valid, everything that happens next looks like ordinary work by a trusted account rather than an intrusion worth investigating.
How it shows up
What helps most is authentication that resists phishing in the first place. CISA is direct about this and names FIDO and WebAuthn as the only widely available phishing-resistant option. After that, three things earn their keep. Mail authentication records configured properly. A payment process where changed bank details always get checked on a second channel. And reporting that is quick and never embarrassing.
Training that punishes failure helps less than people expect. Anyone can be caught on a bad afternoon, and if being caught is humiliating, people go quiet. The hour between the click and the report decides how bad the week gets.
Questions people ask
Phishing, answered
Somebody clicked a link. What do we do first?
Stop interacting with the page, then change the password for that account and end its active sessions. If credentials went in, assume they are already in use.
Then look at what the account could reach, because that is the actual scope of the incident.
Does multi-factor authentication stop phishing?
It helps a great deal and it is not all equal. Codes from an app can be phished in real time by a page that relays them, and push prompts can be worn down by repetition.
CISA points at FIDO and WebAuthn as the only widely available phishing-resistant option, because the protocol refuses to authenticate against the wrong site.
Does phishing training actually work?
The evidence is mixed, and simulation campaigns move the numbers less than most people assume. Training that shames the people who click tends to reduce reporting rather than clicking.
What consistently helps is making the report easy and the response calm, so you hear about it in the first hour.
Can we block it with technology alone?
No. Filters catch the obvious volume, and a message written for one person by somebody who researched them often reads as entirely normal.
Plan for the one that gets through, which means limiting what a single stolen account can do.
Is phishing covered by an application security test?
Not the persuasion part, and we do not test it. Cyberlop does not send simulated phishing or assess your mail filtering.
What a test covers is the aftermath: which records and actions one stolen sign-in reaches, role by role.
Sources
Where this comes from
Related
Terms that sit next to this one
MFA
A second proof beyond the password, usually a code or a hardware key.
Account takeover
An attacker ends up signed in as one of your real users.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Open redirect
A page that forwards visitors to any address handed to it in the URL.
Incident response
The agreed plan for the hours after something has gone wrong.
They got the password anyway
We cannot stop a convincing email. We can show you what one stolen sign-in would reach inside your application, role by role, with the evidence attached. Ask about a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.