Annual training does not solve phishing
Teaching people is necessary. Making them the primary control against convincing pages, adversary-in-the-middle MFA, and approval fatigue is an architecture decision disguised as awareness.
- Nature
- Velqory perspective supported by official technical guidance
- Decision
- How to distribute control across people, identity, email, and response
- Published and verified
- 4 August 2026
- Limit
- No single control eliminates phishing, social engineering, or session abuse
In brief
Velqory's position is that the central metric should not be how many people clicked a simulation, but how much power a click still provides. NIST distinguishes phishing-resistant authentication and explains why manually entered codes are not resistant. CISA and NCSC recommend strong MFA, including FIDO, and layered controls. Training should teach context, reporting, and recovery. Engineering should block reusable credential theft, reduce exposed applications, filter messages and domains, constrain sessions, and make response fast. The aim is not to produce infallible users; it is to prevent an ordinary human error from becoming a material intrusion.
- Replace the zero-click target with zero material compromises caused by one isolated click.
- Use phishing-resistant authentication for the highest-impact accounts and operations.
- Measure reporting time, containment, revoked credentials, and terminated sessions, not only simulation failure rate.
- Reserve training for decisions people can truly make and give them a simple, blame-free reporting channel.
The user should not be the last firewall and the first person blamed
Phishing messages exploit urgency, authority, repetition, and visual similarity. Attackers can control timing, test variants, and imitate a real flow. The person receives the decision amid other work and without the analysis tools available to a security team. Perfect detection is an asymmetric and fragile control.
NIST identifies WebAuthn/FIDO2 as an example of phishing-resistant authentication because it cryptographically binds the proof to the verifier domain. Manually entered secrets or codes can be sent to an impostor. That difference changes the outcome of an error: a victim may open a false page without giving a reusable credential to the wrong domain.
Interrupt the cycle at four moments
- Before deliveryReduce exposure
Close unnecessary applications, protect domains, constrain privileged accounts, and deploy strong identity.
- At deliveryFilter and signal
Combine email authentication, reputation, analysis, sandboxing, and a clear external-origin indicator.
- At authenticationReject the wrong domain
Use phishing-resistant authenticators and session policies proportionate to impact.
- After the signalContain without blame
Provide simple reporting, terminate sessions, revoke secrets, search for scope, and preserve evidence.
Design defence to survive the click
CISA recommends MFA and highlights phishing-resistant options. NCSC compares traditional credentials and FIDO2, including recovery and adoption implications. The right design is not merely buying keys: it means deciding which populations and actions migrate first, how an account is recovered without reintroducing a weak shortcut, and how session abuse is observed.
Start with administrators, email, VPN, source code, payments, and cloud consoles. Then cover third parties and recovery. A FIDO-protected account that can be recovered through weak questions or a weak code retains a side door.
Controls that reduce consequence, not only probability
| Layer | Failure it must absorb | Useful test |
|---|---|---|
| Email and domain | Message imitates a sender or brand | External spoofing, lookalike, attachment, link, and forwarding-rule tests |
| Identity | Person visits a false verifier | Adversary-in-the-middle proxy against the deployed factor |
| Authorisation | Valid session attempts an abnormal action | Step-up, segregation, approval, and least privilege |
| Endpoint | Payload or extension attempts persistence | Execution, isolation, detection, and recovery |
| Response | Signal arrives late or incomplete | Report button, triage, revocation, search, and communication |
| Recovery | Attacker uses reset as a bypass | Identity proofing, cooldown, alert, and factor review |
A simulation should measure the system, not shame the person
Click rate can reveal trends, but it does not say whether the message reached the inbox, the credential could be stolen, reporting worked, or a session would be contained. Compare campaigns by difficulty and population; never use one isolated number as a team ranking.
The most valuable learning is operational: which messages passed, which accounts had weak factors, how long the first report took, how many users reinforced the signal, and how long risk termination took. Share aggregate results and turn each failure into an engineering or process item.
- Measure delivery, interaction, submission, reporting, triage, containment, and recurrence separately.
- Do not request real credentials or collect unnecessary data in a simulation.
- Review recovery and help-desk protection in the same exercise.
- Treat retaliation as an enemy of fast reporting and visibility.
Sources consulted
Consulted on the stated update date.
Opens in a new window.- 01NIST SP 800-63B-4, phishing resistanceNational Institute of Standards and Technology · CY-NISTCSRC
- 02Phishing Guidance: Stopping the Attack Cycle at Phase OneCybersecurity and Infrastructure Security Agency · CY-CISA
- 03More than a PasswordCybersecurity and Infrastructure Security Agency · CY-CISA
- 04Traditional credentials and FIDO2 credentials for personal useUK National Cyber Security Centre · EU-NCSCUK
- 05Product Security Bad PracticesCISA and FBI · CY-CISA
Participate
Share the analysis. Add context.
Distribute the article through your channel or leave an observation connected to the topic.
Comments
Loading the conversation.