Targeted Phishing: Why Spear Phishing Beats Your Awareness Training Every Time

Your annual phishing awareness training probably teaches people to spot the obvious tells: bad grammar, mismatched sender domains, urgent generic threats. That training works reasonably well against bulk phishing. It does almost nothing against a spear phishing attempt built specifically for one person, using details an attacker spent an afternoon collecting about them.

Bulk Phishing and Targeted Phishing Are Different Problems

Bulk phishing plays a numbers game — send the same generic lure to thousands of addresses and count on a small percentage clicking. Filters and general awareness catch most of it. Targeted phishing (spear phishing) is a different attack entirely: the attacker researches a specific person or role, references a real vendor relationship, a real recent transaction, or a real internal project name pulled from LinkedIn, a press release, or a breached data set, and crafts a message that has no generic red flags to spot.

Where Targeting Concentrates

• Finance and accounts payable — business email compromise (BEC) attempts that reference a real vendor and a plausible invoice change, timed around known payment cycles.
• Executives and executive assistants — impersonation of a CEO or board member requesting an urgent wire transfer or gift card purchase, often via a lookalike domain or compromised personal account.
• IT help desk — social engineering calls or messages impersonating an employee requesting an MFA reset or password reset, exploiting the help desk's incentive to be helpful and fast.
• New employees — targeted in their first weeks, before they've internalized who normally contacts them and through what channel.

Annual training measures whether someone can identify a generic phishing email in a controlled test. It doesn't measure whether they'll question a message that references their actual vendor, their actual project, and their actual manager's name.

Why Awareness Training Alone Doesn't Close This Gap

Training raises the floor — it stops the obvious bulk attempts. It does not raise the ceiling against a well-researched, individually crafted message, because the entire point of targeting is to remove the tells the training taught people to look for. Closing that gap requires controls that don't depend on a human correctly identifying a sophisticated fake in the moment.

What Actually Reduces the Risk

• Out-of-band verification for payment or credential changes — a phone call to a known number, not a reply to the email itself, for any vendor banking detail change or urgent wire request.
• Help desk identity verification protocols that don't rely solely on something an attacker could plausibly know (employee ID, manager's name) — tie resets to a pre-registered callback number or in-person verification for sensitive changes.
• Phishing-resistant MFA (see our earlier piece) so a successfully phished credential still doesn't grant access.
• DMARC/DKIM/SPF enforcement at reject, not just monitor, to close off domain spoofing as an entry vector.