He was the operations director of a B2B logistics company with 200 employees. He had been with the company for eight years, was meticulous, responsible, and perfectly aware of digital security risks. And yet, one Tuesday afternoon, he clicked a link in an email that appeared to be from his bank, entered his corporate credentials, and unknowingly handed access to the company's systems to a group that used it for 11 days before anyone noticed.

It wasn't ignorance. It was because the email was extraordinarily convincing, arrived at a moment of pressure, and looked exactly like legitimate communications he had received before.

Why phishing keeps working even though everyone knows it exists

Phishing has been identified as a security threat for decades. There are awareness campaigns, training materials, warnings in email clients. And yet, it remains responsible for the vast majority of security breaches in companies of all sizes.

The reason is that phishing has evolved at the same rate as awareness of it. Modern attacks are not those poorly written emails from the "Nigerian prince." They are personalized messages that mention the recipient's name, reference real projects, perfectly imitate the visual identity of tools the team uses every day, and create artificial urgency that pressures action without thinking.

Social engineering, the art of manipulating people into doing things they normally wouldn't, is fundamentally a human problem. And human problems are not solved by technology alone.

Spear phishing: when the attack is personal

Mass phishing sends the same email to millions of people hoping a small percentage will fall for it. Spear phishing is different: it researches a specific person or company, identifies their relationships, tools, processes, and builds a custom attack.

In the B2B context, the most common spear phishing attacks target:

Impersonating a known vendor requesting payment credential updates or system access.
Impersonating an internal executive asking for an urgent transfer or access to sensitive information.
Creating fake login pages that exactly imitate the tools the team uses — CRM, email platform, analytics tools — to capture real credentials.

Each of these vectors can be devastating if there are no layers of defense beyond the individual judgment of each employee.

What technology can and cannot do

Technological tools are a necessary but insufficient layer of defense against phishing. Advanced spam filters, suspicious domain detection systems, and two-factor authentication significantly reduce risk. But they don't eliminate it.

Two-factor authentication, in particular, is the highest-impact, lowest-effort measure for any B2B team. Even if an attacker obtains a user's credentials, without the second factor they cannot access. Not activating 2FA on critical team tools in 2024 is an omission that is hard to justify.

But 2FA doesn't protect against an employee who, after passing the second factor on a fake page, unknowingly grants access. That's where culture matters.

Building a security culture without creating paranoia

The goal is not to make every employee suspect every email they receive. It's to build the habit of verifying before acting when something seems urgent or unusual.

The practices with the greatest impact are not the most complex:

Establish a clear channel for reporting suspicious emails without friction or judgment.
Conduct periodic phishing simulations, not to catch people but to identify vulnerabilities and learn from them.
Have a simple rule for urgent requests involving money, credentials, or system access: always verify through a second channel before acting.

The security that matters most in most B2B companies isn't in the firewall. It's in the judgment of the people who open emails. And that judgment is built with culture, training, and systems that make doing the right thing easier than doing the wrong thing.

Benefits for your company

Reduction of the most common attack vector: phishing and social engineering are responsible for 85% of successful security breaches. A trained team and correct tools mitigate the most likely risk.
Protection of highest-impact accounts: MFA on CEO, CFO, and system administrator accounts eliminates the most costly scenario: an attacker compromising a high-privilege account.
Self-reinforcing security culture: when employees report phishing attempts, the team learns collectively and the organization becomes more resilient over time.
Reduced cybersecurity insurance costs: insurers require MFA and phishing training to issue policies. Companies that implement them get better coverage at lower cost.

Recommended next steps

Enable MFA on Google Workspace or Microsoft 365: it's the most impactful and quickest control to implement. With MFA active, 99.9% of phishing attacks that obtain the password cannot access the account.
Conduct phishing simulations with the team: tools like KnowBe4 or Gophish allow sending simulated phishing emails to measure who clicks and provide immediate training.
Establish a security reporting channel: create a Slack channel where any team member can report suspicious emails. Respond quickly and visibly to reinforce reporting behavior.

Phishing and Social Engineering: How to Protect Your Company from the Most Used Attack Vector