Multi-channel phishing attacks demand fresh thinking and strategies, and CISOs need a new playbook.
CISOs need a new playbook, stat. Nowhere is this more evident than in the fight against phishing, which costs companies around the world more than US$50 billion per year.
The first modern-day phishing attack took place in the 1990s, when dial-up Internet users were discovering the marvel of email for the first time. Decades later, email continues to be cybercriminals’ favorite method of attack. In fact, more than 90% of successful cyber-attacks start with a phishing email.
But today’s phishing emails are not the same as they used to be. They’re not only more numerous but also more persuasive, and cutting across new communication channels, including text messages, voice calls, QR codes, and social media.
So how can security leaders keep up, and get ahead? Let’s break it down.
How phishing tactics are evolving
Smishing, vishing, quishing, enterprise communication platforms, and social media are fast becoming prime attack vectors, slipping past many of the usual detection and mitigation tools CISOs have in place.
In fact, many of these new tactics hinge on three key elements: AI, social engineering, and information harvesting.
- AI: With generative and agentic AI, attackers can launch highly targeted phishing campaigns at unprecedented speed and efficiency. AI deepfakes and voice cloning, for example, are key parts of the modern attacker’s arsenal, allowing them to create images and videos that are so realistic that even experts struggle to tell the difference between real and fake.
Imagine a spoofed email from the CEO with a malware-laden PDF, followed by a voice-cloned call. Or, an employee using AI to build a spearphishing kit, creating new areas of insider risk. The result: more attacks, in more places, against more targets. - Social engineering, a psychological manipulation phishing technique: To get victims to take the actions they want them to take — like sending money or sharing private information — attackers routinely tug on emotions like fear, guilt, or excitement. Attackers exploit the trust individuals have in well-known companies, senior leaders, and even casual acquaintances. These phishing attacks increasingly arrive at the most stressful periods for companies. For example, during the holiday season, at tax time, and at the end of the fiscal year, because attackers know that employees are more susceptible to making a mistake when they are busy.
- Information harvesting: The number of infostealers — malware designed to covertly steal sensitive information, including personal information, passwords, screenshots, and private documents — delivered via phishing emails increased by 84% between 2024 and 2025.
Attackers who use phishing to harvest login credentials like usernames and passwords sell this information for financial gain or use it to infiltrate networks either for espionage purposes or to launch bigger, more stealthy attacks.
The ultimate prizes are sensitive intellectual property, government secrets, and credential harvesting of high-ranking officials. Consider the 2024 case of a Russian-backed hacking group, which launched a phishing attack in pursuit of sensitive U.S. government information. Earlier in 2025, a Chinese espionage group similarly launched phishing attacks against manufacturing, supply chain entities, and tech companies in Taiwan to gather intelligence data.
Whether they’re seeking money or information, this has allowed attackers to cast a wider net, with a greater chance of engagement.
Anti-phishing steps for CISOs
For CISOs, building the right foundation requires a balance between soft skills and modern security tools. Developing emotional intelligence to foster a safe, non-punitive reporting culture; leadership to influence and build a security-first mindset; critical thinking to anticipate likely attack vectors; and communication and collaboration to educate employees in anti-phishing efforts are essential to any anti-phishing strategy.
Only then can advanced technologies and modern security practices be layered on to strengthen organizational defenses.
- Automation and AI-based security tools to stop attacks
Large language models (LLM), for example, can detect phishing across emails, text messages, social media posts, and other forums. Using natural language processing, they can analyze written text for suspicious language and other red flags and automatically alert enterprises to suspected threats. Some LLMs also spot anomalies like unusual login times or locations, while others use computer vision to detect fake brand logos and malicious QR codes.
Important anti-phishing capabilities to look out for include:- Sentiment and conversation analysis: Uses natural language processing for automated threat detection in text.
- Adaptive authentication: Adjusts security requirements based on high-risk user behavior.
- Automated incident response: Detect and automatically quarantine suspicious messages or devices.
- Threat intelligence: Cross-references phishing indicators with live threat data for early detection.
- Real-time threat analysis to isolate potential hazards
AI-based security tools that come with real-time threat analysis can help organizations quickly identify and contain threats before they reach their human targets.
Among the phishing indicators that organizations should be able to monitor in real time are:- Suspicious sender behavior: Spoofed domains, lookalike email addresses, and new senders who are suddenly attempting to contact numerous employees.
- Suspicious URLs and domains: Poor reputations, unknown links, redirect chains, and credential harvesting pages.
- Malicious attachments: Files with macros, executables, and obfuscated scripts.
- Risky user behavior: Clicking unknown links, downloading files from suspicious sources, and logging in from unusual locations or at unusual times.
- Organization-wide training to increase security awareness
Because phishing scams target human behavior and error, designing and executing a regular anti-phishing training program will help employees recognize signs of phishing across different attack vectors for effective deterrence.
Here are some best practices in mind:- Training must be frequent and continuous to make sure employees at all levels have the most current and accurate information on phishing.
- Prioritize brief, digestible, and focused learning modules instead of long, soup-to-nuts training courses.
- Focus on contextual learning, including scenario-based training and realistic simulations that mimic actual phishing tactics. Real-time feedback when employees fall for simulated attacks also is helpful.
- Tracking progress over time through click rates, reporting rates, and response time is crucial as it helps companies identify and correct shortcomings while rewarding and incentivizing improvement.
Resilience requires vigilance
Phishing may be an old scam tactic, but it’s also an effective one — and cybercriminals are only getting smarter. Even the best defenses can be breached, which is why building resilience matters as much as prevention.
By combining strong security frameworks like zero trust and least privilege with a vigilant, well-informed workforce, organizations can limit the radius of an attack and recover faster. Staying alert, empowering people to report, and reinforcing defenses isn’t just good practice, it’s essential to keeping threats at bay.
