Attacks don't come in through the server: they come in through an email

Most cyberattacks on companies don't start with someone cracking a firewall from a basement. They start with a perfectly ordinary email that somebody on the team opens on a random Tuesday mid-morning. I know because I've spent years as the IT security lead of an industrial company, and of all the attacks I've seen up close, almost none went after a machine. They went after a person.

That's the uncomfortable part: you can spend a fortune on technology and still be exposed, because the attacker won't fight your firewall if they can convince someone on your team to open the door.

◢Why they target people, not machines

It's pure economics. Breaking into a well-protected system takes time, money and skill. Fooling a person takes one email. The modern attacker doesn't "hack": they impersonate, pressure and persuade. They pose as a supplier, a bank, your boss. And they only need it to work once in a thousand tries, because sending a thousand emails is free.

That's why a company's security isn't defined by its technology. It's defined by the least prepared person with access to an inbox. And you don't fix that by buying another box: you fix it with training.

◢Phishing in 2026 no longer has typos

For years the classic tell was clumsy writing: if the email was badly written, it was a scam. That clue is dead. With generative AI, fraudulent emails arrive flawless, in your language, logo in place, with believable context. And it goes beyond text: there are already scams using cloned voices that sound like your CEO asking for an urgent transfer over the phone.

The consequence is direct: if your team learned to spot phishing five years ago, they're trained against an enemy that no longer exists.

◢The signals that still work

The good news is that some signals can't be polished away by AI, because they're part of the scam itself:

• ▹Urgency plus money or credentials. "Transfer today", "your account gets blocked in 24 hours". The rush is the attacker's tool: it exists so you don't think.
• ▹The real domain doesn't add up. The display name can say anything; what matters is what's behind it. An email from "Bank of America" sent from some odd domain is all you need to see.
• ▹The link doesn't go where it says. Hover without clicking and look at the real address. If the text says one thing and the link another, that's the whole story.
• ▹Last-minute changes to payments. The classic: a "supplier" announces a new bank account right before an invoice is due. This scam has been ruining companies for years precisely because it looks like routine.
• ▹Requests outside the usual channel. If your boss never texts you and today asks you by SMS to buy gift cards, that's not your boss.

And the golden rule that sums them all up: when in doubt, verify through another channel. Call the usual number, not the one in the email. Ask in person. Thirty seconds of checking dismantles 99% of the tricks.

◢If someone falls for it, the first hours are everything

Here's the part almost no company gets right: what happens after the click. If the person who fell for it fears getting blasted, they'll hide it, and the attacker gets days to move around inside. If the culture is "report it fast and nothing happens to you", you'll have the incident contained within the hour: password changed, session cut, rest of the team warned.

The person who reports in time is not the problem. They're the one who saves you.

◢The minimum every team should have

Nobody needs to become an engineer. Four habits remove most of the real risk:

1. ▹Two-factor authentication on email and on anything touching money or data.
2. ▹A password manager: a different password per service without memorizing any of them.
3. ▹Second-channel verification for any request involving money, credentials or account changes.
4. ▹Knowing who to alert, and making sure alerting is always safe.

◢This can be trained

None of the above is hard. The hard part is making it stick across the whole team, from the shop floor to management, and keeping it fresh while the scams change every year. That's exactly what I do: I deliver cybersecurity training for companies, built so everyone gets it, not just the technical staff, with the cases and signals I've seen work in the real world.

You still need the firewall, of course. But the day the right email lands, what will protect your company is that the person opening it knows what they're looking at.