Phishing is a business risk, not simply an IT problem

A convincing message can move from an employee’s inbox to financial loss, exposed data and operational disruption remarkably quickly. Treating phishing as a technical issue alone leaves too many of the important decisions elsewhere in the business unaddressed.

Phishing becomes a leadership issue when the consequences can affect finance, operations, customers, data and reputation.

Phishing is often discussed in the language of email filters, malicious links and compromised accounts. Those elements matter, but they describe the method of attack rather than the business risk it creates.

The message itself may be only the first step. A stolen password can provide access to an inbox or business application. An attacker can study genuine conversations, impersonate a trusted colleague or supplier, alter payment information, steal sensitive data or use the account to target other people. What began as a routine-looking request can quickly become a financial, operational and reputational incident.

For that reason, responsibility cannot sit with IT alone. Technology teams can reduce the likelihood and impact of an attack, but many of the decisions that determine whether it succeeds belong to leadership, finance, HR, procurement and operational teams.

Effective phishing attacks rarely look completely out of place. They are designed to resemble the communications people already receive: a Microsoft 365 alert, an invoice query, a supplier bank-detail change, a document shared by a colleague or an urgent request from a senior leader.

Attackers take advantage of familiar brands, established relationships and normal working pressure. They may use information available online to make a message more credible. They can move between email, messaging platforms, text messages, phone calls and QR codes, creating a sequence that feels more convincing than a single unexpected email.

This means the organisation’s own working practices form part of its defence. If important payment changes are routinely approved through email, or urgent requests from senior people are rarely challenged, attackers are presented with a process they can imitate.

Modern attacks increasingly focus on identity: the accounts and credentials that allow people to enter systems, access information and act with authority.

A compromised account can be more valuable than a malicious attachment because it allows an attacker to operate from inside a trusted environment. Messages sent from a genuine mailbox are more difficult for colleagues and customers to question. Existing conversations provide context, while account permissions determine how far the attacker can move.

Protecting identity should therefore be considered alongside the protection of money, systems and data. Strong account controls, appropriate access, multi-factor authentication, monitoring and rapid removal of access all form part of the business control environment, not merely the IT configuration.

A fraudulent payment is an obvious consequence, but phishing incidents can create much wider costs. Teams may lose access to systems while an incident is investigated. Customers and suppliers may need to be contacted. Data exposure can create legal and regulatory responsibilities. Senior people are drawn into response activity, while normal work is delayed.

Trust can also be affected. A customer who receives a convincing fraudulent message from a compromised company account may reasonably question how their information and communications are protected. Even when the direct financial loss is contained, the organisation may face a lengthy process of restoring confidence.

Leaders influence phishing resilience through the expectations they create. Can an employee challenge an unusual request from a director without being seen as obstructive? Is there a clear way to verify a supplier payment change? Can someone report that they clicked a link without fear of blame? Does the business know who will make decisions if an important account is compromised?

These are management questions. They determine whether people pause, verify and report quickly. Or proceed because speed, hierarchy or uncertainty makes that feel easier.

A useful phishing-risk conversation should include:

• Which financial, operational and customer processes could an attacker imitate?
• Which accounts and people could cause the greatest impact if impersonated?
• How are unusual payments and sensitive changes independently verified?
• Can employees report a suspected mistake immediately and without blame?
• Does the organisation have an agreed response when an account is compromised?

Phishing may begin with technology, but it succeeds or fails across the whole organisation. Effective protection brings together secure accounts and devices, well-designed business processes, informed employees and a practised response plan.

Pinnacle helps organisations review those connected risks and strengthen their resilience across people, process and technology. The objective is not to promise that no deceptive message will ever reach an employee. It is to make the business harder to exploit, and better prepared to respond before one message becomes a major incident.

If you want to discuss further with our experts, contact us now