A targeted phishing attack aimed at a specific person or organization, using personal details to make the message more convincing.
General phishing sends the same message to many people and hopes a few respond. Spear phishing is carefully tailored. Attackers research their target through company websites, social media, and previous data breaches, then write a message that refers to real colleagues, projects, suppliers, or events.
For example, an employee in accounts payable might receive an email that appears to come from a known supplier, mentions a real recent order, and asks for payment to updated bank details. Because the message looks familiar and relevant, it is far more likely to succeed than a generic scam. Attacks aimed at senior executives are sometimes called whaling. Defenses include security awareness training, email authentication, verifying payment changes by phone using known contact details, and multi-factor authentication.
A scam in which criminals impersonate or take over a business email account to trick staff into sending money or sensitive data.
PhishingA social engineering attack that uses fake emails, messages, or websites to trick people into revealing information or installing malware.
Social EngineeringManipulating people into breaking security practices, such as sharing passwords or granting access, rather than attacking technology directly.
CMMC is now in DoD contracts, and third-party Level 2 assessments start appearing November 10, 2026. Here's what each level requires and the first steps for small suppliers.
Annotated example emails showing the exact clues employees should check before clicking, plus what to do when a suspicious message lands in your inbox.
Passkeys replace passwords with phishing-resistant cryptography built into your devices. Here is how they work, how to start using them, and how businesses can roll them out.