The Filter Said Safe. The User Clicked Anyway.

Your email gateway blocked 10,000 messages last month. But it only takes one to get through. Phishing remains the leading initial access vector, appearing in more than half of observed incidents. The problem isn't just volume. It's evolution.

Attackers now rotate delivery tactics weekly. They use QR codes to sidestep URL scanning. They host lures on legitimate cloud platforms your filters trust. They steal session tokens that let them bypass MFA entirely.

Traditional defenses catch known threats. But the threats that matter most are the ones your filters have never seen.

Why This Matters Now

Organizations have invested heavily in email security. Multi-factor authentication is nearly universal. Endpoint detection tools monitor every device. Yet phishing continues to deliver initial access at scale.

The reason is simple. Technical controls filter what they recognize. Attackers adapt faster than signature databases update. When a phishing email reaches an inbox, the decision to click becomes a human judgment call. That judgment is shaped by training, context, and habit.

Recent data from Cisco Talos shows phishing as the primary access method in breach engagements. The gap between what filters stop and what users encounter is widening. Attackers exploit that gap by crafting messages that look legitimate, sound urgent, and bypass automated inspection.

This is not a failure of technology. It is a recognition that defense requires both technical and human layers. The organizations reducing phishing risk most effectively are those treating user behavior as part of the security architecture.

Three Strategic Gaps Exposed

Email Filters Only Block What They Already Know

Signature-based detection works when threats are cataloged. Attackers now build lures on trusted domains, embed malicious links in QR codes, and rotate phishing infrastructure faster than reputation systems can flag them.

• Legitimate cloud services host credential harvesting pages that evade URL scanning
• QR code phishing bypasses text-based analysis entirely
• Attackers use compromised accounts to send messages from trusted sources
• Zero-day phishing campaigns arrive before signature updates distribute

Annual Training Does Not Match Weekly Tactic Shifts

Most organizations run awareness training once or twice per year. Attackers cycle lure templates, impersonation tactics, and delivery methods weekly. The mismatch creates a persistent window of vulnerability.

• Users forget training details within weeks of completion
• New phishing techniques emerge faster than annual training cycles can address
• One-time education does not build the reflexive caution needed to evaluate unfamiliar messages
• Security teams lack visibility into which users remain susceptible between training events

MFA Does Not Stop Session Token Theft

Multi-factor authentication protects credentials at the point of login. Attackers now steal session tokens after authentication completes, allowing them to impersonate users without needing passwords or second factors.

• Adversary-in-the-middle proxies capture tokens during legitimate login flows
• Stolen tokens grant access until they expire, often hours or days later
• Users receive no alert when their session is hijacked post-authentication
• MFA provides a false sense of complete protection while attackers adapt their methods

The Strategic Shift Required

Effective phishing defense now requires treating user behavior as measurable, trainable, and improvable. Technical controls remain essential. But they must be paired with continuous education that adapts as quickly as attacker tactics do.

Organizations need visibility into which users open risky emails, which click suspicious links, and which enter credentials on spoofed pages. That visibility must inform coaching that happens in real time, not months later during the next training cycle.

The goal is not to replace email filters or eliminate MFA. It is to build a human defense layer that complements technical controls by reducing the likelihood that users will complete the actions attackers need to succeed.

• Simulate phishing attacks to identify users who need additional coaching
• Deliver training that reflects current attacker techniques, not outdated examples
• Provide real-time feedback when users engage with simulated threats
• Measure progress by tracking susceptibility rates over time, not just training completion

How KnowBe4 Platform Addresses This

KnowBe4 provides security awareness training and phishing simulation designed to reduce human risk at scale. The platform targets the gaps technical controls leave open.

• Gap 1: KnowBe4 simulates the phishing tactics email filters miss, including QR code lures and cloud-hosted credential harvesting, training users to recognize threats before they escalate.
• Gap 2: AI-native training adapts content to user behavior and evolving attack methods, delivering continuous education that matches the pace of tactic shifts rather than relying on annual sessions.
• Gap 3: Real-time coaching alerts users when they engage with simulated phishing, reinforcing caution at the moment of risk and building reflexive awareness that complements MFA protections.

Organizations using KnowBe4 report measurable reductions in phishing susceptibility. In documented deployments, baseline susceptibility dropped from 33.1% to 4.1% over 12 months. The platform integrates with Microsoft 365 and Active Directory, fitting into existing security architectures without requiring infrastructure changes.

Who This Is For

• Information Security Program Managers seeking measurable phishing risk reduction
• Security Awareness Managers responsible for workforce training programs
• IT Managers defending Microsoft 365 and Active Directory environments
• Security Operations teams looking to close the human gap in layered defenses

Call to Action

See how KnowBe4 reduces phishing susceptibility in environments where email filters alone are not enough. Visit https://knowbe4.optrics.com/platform.html

FAQ

Why do phishing emails still reach inboxes despite email security tools?
Attackers use tactics that evade signature-based detection. QR codes bypass URL scanning. Compromised accounts send messages from trusted sources. Lures hosted on legitimate cloud platforms pass reputation checks. Filters block known threats, but phishing campaigns evolve faster than signature databases update.

How does training reduce phishing risk when technical controls are already in place?
Training changes user behavior. When a phishing email reaches an inbox, the user decides whether to click. Education builds the judgment needed to evaluate unfamiliar messages. Real-time coaching reinforces caution at the moment of risk. Measurable susceptibility reductions show training complements technical defenses.

What makes KnowBe4 different from other security awareness platforms?
KnowBe4 uses AI-native training that adapts to user behavior and current attack tactics. The platform simulates threats email filters miss, including QR code phishing and cloud-hosted lures. Real-time coaching delivers feedback when users engage with simulated threats. Integration with Microsoft 365 and Active Directory fits existing environments.

Can MFA protect against phishing if attackers are stealing session tokens?
MFA protects credentials at login but does not prevent session token theft. Attackers use adversary-in-the-middle proxies to capture tokens after authentication completes. Stolen tokens grant access until expiration. User training helps identify suspicious login pages and reduces the likelihood of token compromise.