What is phishing?

What phishing is

Phishing attacks the person rather than the technology. Instead of breaking through a firewall, the attacker sends a message designed to look legitimate, an email that appears to come from a trusted colleague, a bank, a software vendor, or an internal system, and persuades the recipient to do something that compromises security: hand over a password, click a link to a fake login page, or open an attachment that installs malware. The name is a play on fishing, because the attacker casts out bait and waits for someone to bite.

What makes phishing so effective is that it exploits human psychology rather than a software flaw. A well-crafted message creates urgency, fear, curiosity, or trust, your account will be suspended, here is an invoice you owe, the CEO needs this now, so the recipient acts before thinking. Because it targets people, phishing works even against organizations with strong technical defenses, which is why it remains one of the most common and successful attack techniques year after year.

The main types of phishing

Phishing has evolved into several distinct forms, each tuned to a different situation.

• Bulk phishing: generic messages sent to huge numbers of people, relying on a small percentage falling for them.
• Spear phishing: targeted messages crafted for a specific person or organization, using real details to appear convincing.
• Whaling: spear phishing aimed at senior executives, whose access and authority make them high-value targets.
• Business email compromise (BEC): impersonating an executive or vendor to trick staff into transferring money or data.
• Smishing and vishing: phishing carried out over SMS text messages or voice calls rather than email.

Why phishing matters so much for ransomware

Phishing is one of the most common entry points for ransomware. In a typical attack chain, the initial access the attacker needs, a foothold inside the network, is obtained by phishing an employee into either entering their credentials on a fake page or running a malicious attachment that installs a remote-access tool. From that single compromised account or machine, the attacker then begins the long campaign of exploration, lateral movement, data theft, and eventual encryption.

This is why phishing is not a minor nuisance but a serious strategic risk. A single employee clicking a single convincing link can be the opening move in a full ransomware attack that takes down an entire hospital. The phishing email is the match; the ransomware is the fire. Understanding this connection is important, because it means defending against phishing is defending against ransomware at its source.

How organizations defend against phishing

Because phishing targets people, defense combines technology, training, and resilience. On the technical side, email-filtering and anti-spoofing controls block many malicious messages before they reach an inbox, and multi-factor authentication limits the damage of a stolen password by requiring a second factor the attacker does not have. Security awareness training helps staff recognize suspicious messages and creates a culture where reporting a possible phish is encouraged rather than embarrassing.

But no anti-phishing effort is perfect, because the attacker only needs to fool one person once, and the messages keep getting more convincing, now often aided by AI that writes flawless, personalized lures. This is the crucial point: a realistic defense assumes that eventually a phish will succeed and someone's credentials or device will be compromised. What matters then is what the attacker can do with that foothold. An environment with continuous verification of access, segmentation to limit lateral movement, behavioral detection to catch the intrusion, and the ability to recover cleanly turns a successful phish into a contained event rather than a catastrophe. Phishing defense, in other words, is both about stopping the click and about making the click survivable.

How to recognize a phishing message

While technology blocks much phishing, the human ability to spot a suspicious message remains a vital layer, and the warning signs are worth knowing. Classic tells include a sense of manufactured urgency or threat, act now or your account will be closed; requests to click a link and log in, or to open an unexpected attachment; a sender address that looks almost right but is subtly wrong; generic greetings where a real sender would use your name; and requests for credentials, payment, or sensitive data that would be unusual for the supposed sender. Hovering over a link to see where it really goes, before clicking, catches many fakes.

That said, it would be a mistake to put the whole burden on individuals spotting these signs, because modern phishing has become extremely polished. Spear-phishing messages use real names, real projects, and accurate context harvested from social media or previous breaches, and AI now produces grammatically perfect, convincingly personalized lures at scale, stripping away the clumsy wording that used to give phishing away. The realistic stance is that even careful, well-trained people will occasionally be fooled by a sufficiently good message. Training reduces the rate of successful phishing, which is valuable, but it cannot drive it to zero, which is exactly why the layers that make a successful phish survivable matter as much as the ones that try to prevent the click.