Phishing in 2026: why the inbox still wins
Language models have made phishing emails flawless, and push-fatigue has made MFA bypassable. Training people to spot typos no longer works. What does, and how to measure it.
For a decade, phishing training taught one lesson: look for the mistakes. The odd greeting, the broken grammar, the logo that is slightly off. That lesson has expired. Generated text is fluent in any language, matches your company's tone, and references the project your finance team actually discussed last week.
The inbox still wins because it sits where people make fast decisions under mild pressure. The fix is to stop relying on people to be perfect detectors, and design so that a single click is not enough.
What modern phishing actually looks like
- Adversary-in-the-middle login pages that proxy your real sign-in screen, capture the session cookie after MFA, and replay it. The user sees a normal login and a normal inbox.
- MFA fatigue, where an attacker with a stolen password sends push prompts until someone taps approve to make it stop.
- Business email compromise with no link and no attachment, just a polite request to update supplier bank details, sent from a real but compromised partner mailbox.
- Voice and video follow-ups, where the email is only the setup and the real pressure arrives by phone.
Controls that do not depend on spotting the trick
Phishing-resistant authentication
Passkeys and hardware security keys are bound to the real domain. A lookalike login page cannot use them, no matter how convincing it is. This is the single control that removes the most common modern attack entirely.
Number matching and context on push prompts
If you still use push MFA, require the user to type a number shown on the login screen. It ends the approve-to-silence pattern.
Out-of-band checks for money and access
Any change to payment details, any urgent transfer, any request for credentials gets confirmed through a channel the requester did not choose: a known phone number, a ticket, a face-to-face check. Write it down as a rule, not a suggestion, so nobody feels rude for following it.
Make reporting effortless and rewarded
A report button in the mail client, an acknowledgement within minutes, and a visible thank-you. The goal is a culture where reporting a false alarm is normal and slightly praised.
Measure the right thing
Click rate on simulations is a vanity metric. It goes down when simulations get easier and up when they get realistic. Track these instead:
- Report rate: the share of simulated and real phishing that someone reports.
- Time to first report: how quickly the first person flags a campaign. This is what lets you pull the message from every other inbox.
- Coverage of phishing-resistant MFA across high-risk roles.
People are not the weakest link. They are the only sensor in the building that can recognise a strange request from a familiar name.
Train for that role, give them a fast way to raise a hand, and remove the attacks that no amount of training would stop.
Designs phishing simulations and awareness programmes that people actually remember.
A short consultation: we walk your surface and show where to start.