The phishing email lands at 3pm on a Tuesday. The subject line looks legitimate. The sender name matches a known vendor. Your employee has completed the annual security awareness training. They've passed three simulated phishing tests this year.
They click it anyway.
This is not a failure of the employee. This is a failure of the security strategy. Human beings — under pressure, tired, busy, facing increasingly sophisticated attacks — will make mistakes. Building a security posture that depends on perfection from 500 humans is not a posture. It's hope.
What Training Does and Doesn't Achieve
Security awareness training is not worthless. Done well, it raises the general security IQ of your organisation, helps people recognise obvious social engineering, and satisfies compliance requirements.
But it has hard limits:
- AI-generated spear-phishing is contextually aware, grammatically perfect, and personalised. "Look for bad grammar" is obsolete advice.
- Training degrades under pressure. The executive in a crisis is not running the security checklist before clicking.
- Click rates plateau. Even well-trained populations maintain a residual click rate that is enough for a targeted attacker.
- Training cannot prevent credential stuffing, brute force, or token theft.
The Technical Controls That Actually Work
Multi-Factor Authentication. MFA blocks over 99% of automated credential attacks (Microsoft data). But SMS-based MFA is vulnerable to SIM swapping; push notifications are vulnerable to MFA fatigue; FIDO2 hardware keys are phishing-resistant by design. For high-risk users, phishing-resistant MFA is mandatory.
Conditional Access. Enforces access policy based on context: who is signing in, from what device, from what location. A login from an unmanaged device in an unusual country at 2am is blocked automatically — regardless of whether the credentials are valid. Stolen credentials become significantly less useful.
Device Compliance. Managed devices with EDR, disk encryption, and current patches represent a fundamentally different risk profile. Conditional Access policies requiring device compliance prevent corporate resources from being accessed via compromised personal endpoints.
Email Security Layers. DMARC, DKIM, SPF protect against domain spoofing. Email filtering with sandboxing detonates suspicious attachments before they reach the inbox. No user action required at all.
The Right Balance
The hierarchy should be: Architecture first (Conditional Access, MFA, network segmentation, device compliance), then Detection (SIEM, identity anomaly detection, EDR), then Training as a supporting layer.
When your architecture is correct, a user clicking a phishing link is a containable incident. The attacker gets credentials that don't work without MFA. Device compliance blocks pivoting. Anomaly detection flags the attempt in minutes. The goal is to make human error recoverable — not to prevent all human error.
Contact ExColo to review your identity security architecture →
