What is it
Phishing is an attempt to make someone hand over credentials, approve something, or run a file, by impersonating a source they trust. It targets judgement rather than software, which is why patching does not fix it.
How it works
An attacker sends a message that appears to come from a trusted source and creates a reason to act quickly. The message points to a page that captures credentials, or an attachment that runs code, or simply asks for an action such as changing bank details. Modern campaigns are researched and specific, referencing real colleagues and real projects.
Why it matters
Phishing is the initial access step in a large share of breaches. It is cheap for the attacker, scales without effort, and needs to succeed only once against one person on one bad day.
What can happen
Credential theft leading to account takeover, fraudulent payments, malware execution, and onward access to systems the compromised account could reach.
How to detect it
Reported messages from staff are the highest-value signal you have. Watch for newly registered lookalike domains, mail failing SPF or DMARC, unusual login locations shortly after a campaign, and inbox rules created to hide replies.
How to defend
Deploy origin-bound MFA so stolen credentials alone are insufficient. Enforce DMARC so your domain cannot be spoofed. Make reporting a message easier than deleting it. Train with realistic examples rather than generic warnings. Verify payment changes out of band, always.