Adam Myers

Phishing remains one of the most common entry points for cyber attacks.

CyberLab outlines what phishing is, why it matters, how to enable people to recognise and avoid it, and how organisations can gain confidence that defences are working.

Phishing is a form of social engineering where an attacker sends a deceptive message that appears to come from a trusted source. The goal is to trick the recipient into taking an action, for example entering credentials, opening a malicious attachment, approving a fraudulent payment, or installing malware that leads to ransomware or data theft.

Phishing is serious for three reasons:

• It targets people, not just systems. Even well secured environments can be compromised if a user is manipulated into granting access.
• It often starts bigger incidents. Many breaches begin with a single click that leads to credential theft, lateral movement and impact on critical services.
• It keeps evolving. Messages are increasingly polished, personalised and timed to match real business processes, which reduces the likelihood that staff will recognise them on sight.

Technology is necessary, but it is not sufficient on its own. Building capability in people requires an ongoing programme that is practical, engaging and measurable.

Design training for how adults learn

• Short, focused modules. Ten to fifteen minute sessions, delivered regularly, improve retention without disrupting the day.
• Varied formats. Video, interactive scenarios, quick reads and micro‑quizzes cater for different learning styles.
• Role‑specific examples. Finance teams, customer service and executives face different lures and require tailored scenarios.
• Just‑in‑time nudges. Brief reminders at the point of risk, for example before seasonal peaks or system changes, reinforce good judgement.

Make simulations realistic and continuous

• Diverse templates. Use a wide variety of lures and brands so knowledge cannot spread as “avoid that specific email”.
• Adaptive scheduling. Send simulations at different times and frequencies so vigilance becomes a habit, not a one‑off event.
• Teachable moments. If a user interacts with a simulation, show a friendly landing page that explains the red flags they missed and how to spot them next time.

Encourage reporting, not silence

• One‑click reporting. Provide a report phishing button in email clients and make sure it is monitored.
• Positive tone. Thank staff for reporting, even if the message turns out to be benign. Avoid blame, focus on learning.
• Clear playbooks. Ensure staff know what to do if they have clicked. Quick reporting enables faster containment.

Occasional simulations and a long video once a year do not provide assurance. A stronger approach combines training, testing and metrics.

• Run continuous, varied simulations. Measure click rates, data submission, and reporting rates. Aim to improve all three.
• Segment results. Understand performance by team, location and role. Target support where it is most needed.
• Close the loop. Provide immediate feedback to participants, offer quick refreshers to those who need them, and celebrate improvement publicly.
• Test processes, not just people. Validate that reported emails reach the right team, that triage is timely, and that containment actions are triggered.

Beware common pitfalls: over‑reliance on a single template, predictable schedules that are easy to game, or punitive responses that discourage reporting.

A layered programme combines people, process and technology.

People and process

• Establish a security awareness plan with quarterly themes, micro‑modules and ongoing simulations.
• Define a clear policy for reporting suspected phishing and responding to mistakes without blame.
• Run tabletop exercises that include finance approvals, supplier changes and executive impersonation scenarios.
• Provide onboarding and refresher pathways so new joiners and high‑risk roles receive timely guidance.

Technical controls

• Email security gateway with attachment sandboxing, URL rewriting and impersonation detection.
• Authentication hardening with multi‑factor authentication, conditional access and device posture checks.
• Domain protections using SPF, DKIM and DMARC with alignment and reject policies.
• Browser and DNS filtering to block known malicious destinations and risky categories.
• Endpoint protection with behaviour‑based detection and rollback for ransomware scenarios.
• Least privilege and separation of duties for sensitive actions, for example payment approvals and credential resets.
• Automation and orchestration so that reported messages are auto analysed and similar emails are removed from other mailboxes.

What good looks like

• Training completion above a defined threshold, improved assessment scores over time, and increased voluntary reporting.
• Declining click‑through and data submission rates on simulations, with faster reporting of real threats.
• Documented response playbooks, measured mean time to triage and containment, and regular post‑incident reviews.

Malware is one of the most persistent threats to modern businesses. CyberLab outlines what malware is, how the threat has evolved, and five practical steps any organisation can take to reduce risk and strengthen defences.

Malware (short for “malicious software”) is an umbrella term for software designed to infiltrate systems, disrupt operations, or steal data. Categories often overlap, but common types include:

• Viruses
  Malicious code that attaches to legitimate files and can corrupt, modify, or delete data.
• Worms
  Self‑propagating software that spreads across connected devices and networks without user action.
• Trojans
  Malware that masquerades as legitimate software, often creating a “backdoor” that allows further compromise.
• Adware
  Software that displays intrusive adverts; beyond nuisance, it can weaken security and lead to additional malware.
• Spyware
  Software that covertly captures sensitive information such as credentials, payment data, and browsing activity.
• Rootkits
  Tools that provide stealthy, privileged access so an attacker can operate like an administrator without detection.

Historically, threats tended to sit neatly within one category. Today, adversaries combine techniques to maximise impact. A single campaign might hide like a trojan, spread like a worm, disrupt systems like a virus, and quietly harvest credentials.

Motivations have also shifted. Where older malware often aimed to cause nuisance, modern operators are financially driven. Ransomware remains one of the most common and disruptive threats: attackers encrypt business data and demand payment for decryption. Increasingly, groups use double‑extortion tactics, exfiltrating sensitive data before encryption, then threatening to leak it to increase pressure on victims.

The implications are clear. Organisations need layered controls that can prevent, detect, and respond to sophisticated, multi‑stage attacks, and they need the governance and processes to recover quickly.

1) Use modern endpoint protection

Traditional antivirus relies on signatures of known threats. Given the pace of change, that is no longer sufficient by itself. Organisations should adopt behaviour‑based protection such as Endpoint Detection and Response (EDR) or Next‑Gen AV, which use analytics and machine learning to detect suspicious activity, block unknown malware, and provide investigation and response capabilities. Consider managed detection to extend coverage outside business hours.

What good looks like:

• Behaviour‑based detection, not only signatures
• Ransomware rollback or containment features
• Centralised policy, alerting and response across all endpoints

2) Manage devices and privileges

Limit administrative rights and separate admin accounts from day‑to‑day user accounts. Apply least privilege and strong authentication to reduce the blast radius if an account is compromised. For mobiles and laptops, use device management to enforce security baselines, control app installation, and protect corporate data.

What good looks like:

• Role‑based access, separate admin credentials, multi‑factor authentication
• Mobile and endpoint management (for example, Microsoft Intune) to enforce policies
• Only approved app stores such as Google Play and the Apple App Store

3) Keep software up to date

Attackers routinely exploit known vulnerabilities. Maintain an accurate asset inventory, apply security updates promptly, and remove software that is end‑of‑life or unsupported. Regular vulnerability assessments help identify gaps and track remediation progress.

What good looks like:

• Standard patching cadence with clear service‑level objectives
• Prioritisation for internet‑facing and business‑critical systems
• Continuous scanning and reporting to verify closure of issues

4) Control USB and other removable media

Removable media can introduce malware into otherwise controlled environments. Reduce risk by blocking ports where not required, restricting device types, and scanning any permitted media. Provide secure alternatives for file transfer so staff do not need ad‑hoc USB sticks.

What good looks like:

• Default block on removable storage, allow by exception with approval
• Device control and data loss prevention to monitor usage
• Approved, secure file‑sharing solutions and clear guidance for staff

5) Use firewalls and network controls

Firewalls act as a first line of defence between internal networks and the internet. Apply default deny where practical, restrict inbound and outbound traffic, and enable features such as intrusion prevention and web filtering. Use host firewalls on endpoints and segment internal networks to limit lateral movement.

What good looks like:

• Properly configured perimeter and host‑based firewalls
• Application‑aware controls, DNS and web filtering
• Segmentation of critical services and monitoring of east‑west traffic

No single control stops every threat. A layered approach that combines prevention, detection, response, and recovery is essential. Training and clear processes matter as much as technology. When organisations align controls to their risk profile and keep them well managed, they significantly reduce the likelihood and impact of malware incidents.

CyberLab helps organisations assess their exposure, strengthen controls, and get more value from existing tools. To discuss how to improve protection against malware and wider cyber threats, the team is available to help shape a pragmatic plan that fits the environment, budget, and risk appetite.

When people think of insider threats, they often picture a disgruntled employee misusing legitimate access. In reality, one of the most dangerous risks comes from well‑intentioned employees being manipulated by attackers. This is the essence of social engineering.

Social engineering is a tactic where attackers exploit human behaviour rather than technical flaws. Instead of breaking through firewalls, they trick individuals into giving away information, credentials or access. These attacks rely on trust, curiosity or a desire to help.

Unlike malicious insiders, social engineering attacks are usually launched by external actors who manipulate employees into actions that compromise security – such as clicking a malicious link or sharing sensitive data.

Phishing

The most widespread form of social engineering. Attackers send emails, messages or create fake websites that mimic trusted organisations (banks, government agencies, major brands). Victims are lured into entering credentials or downloading malware.

Baiting

Offering something enticing – like free music downloads or branded USB drives – in exchange for action. Once the bait is taken, malware is installed or data is harvested.

Quid Pro Quo

An attacker offers a service in return for information. For example, posing as IT support and offering “free troubleshooting” in exchange for login details.

Pretexting

Building a false sense of trust by impersonating someone in authority (e.g., HR, IT, auditors). The attacker fabricates a scenario to justify requests for sensitive data or access.

Piggybacking (Tailgating)

Physical intrusion by following an authorised person into a restricted area or borrowing a device under false pretences. For example, asking someone to hold a door open because they “forgot their badge”.

• Human nature: People want to be helpful and avoid conflict.
• Authority and urgency: Attackers often create pressure to act quickly.
• Familiarity bias: Impersonating colleagues or trusted brands lowers suspicion.

1. Be cautious with emails and attachments

If you don’t recognise the sender, don’t engage. Even if you do, verify suspicious requests through a separate channel (e.g., call the person directly). Remember: email addresses can be spoofed.

2. Use layered security

Deploy professional spam filters and enable multi‑factor authentication (MFA). MFA adds a critical layer of defence if credentials are compromised.

3. Think before you click

If an offer seems too good to be true, it probably is. A quick online search can confirm whether it’s legitimate or a scam.

4. Secure your devices

Maintain a standard build, keep antivirus and firewalls active, and apply patches promptly. Outdated systems are easy targets.

5. Educate and test regularly

Run security awareness training and simulated phishing exercises. People are the first line of defence – make sure they know how to spot and report suspicious activity.

Technology alone cannot stop social engineering. The most effective defence combines awareness, process and technology.

By training staff, enforcing strong access controls and maintaining layered security, organisations can significantly reduce the risk of a successful attack.