When most people think about cyberattacks, they imagine sophisticated hackers breaking into secure networks using advanced tools and techniques. In reality, many successful attacks begin with something much simpler: a deceptive email.

Phishing remains one of the most common cyberattacks worldwide because it targets people rather than technology. Instead of attempting to bypass security systems directly, attackers trick employees into revealing passwords, opening malicious attachments, or clicking harmful links.

As organizations become increasingly dependent on digital systems and cloud-based services, understanding and preventing phishing attacks has become a critical management responsibility.

What is a Phishing Attack?

A phishing attack is a form of cybercrime in which attackers impersonate a trusted person, organization, or service to convince users to disclose sensitive information.

• Stealing usernames and passwords
• Obtaining financial information
• Installing malware
• Gaining access to organizational systems
• Conducting further attacks within a network

Common examples include fake Microsoft login pages, fraudulent banking emails, messages pretending to be company executives, and fake package delivery notifications.

Why Phishing is So Effective

Modern organizations invest heavily in technology such as firewalls, antivirus software, and intrusion detection systems. However, attackers understand that people are often easier targets than computers.

• Creating a sense of urgency
• Appearing to come from a trusted source
• Mimicking legitimate branding
• Requesting immediate action

Even highly experienced employees can make mistakes when under pressure. This shows that cybersecurity failures are often linked to human behaviour, not only technical weaknesses.

Real-World Example: The Microsoft Exchange Server Attacks

In 2021, the Microsoft Exchange Server attacks affected organizations around the world. Although the incident involved technical vulnerabilities, it also demonstrated how cybercriminals often combine technical attacks with social engineering techniques to gain further access.

This example highlights the need for organizations to combine technical security controls with employee awareness, monitoring, and incident response planning.

How Information Systems Managers Can Reduce Risk

Information systems managers play a critical role in reducing phishing risk. They are responsible for ensuring that security is treated as an organizational priority rather than only an IT issue.

1. Security Awareness Training

Employees should receive regular training on identifying suspicious emails, recognizing social engineering tactics, and reporting potential threats. Training should be continuous rather than a one-time activity.

2. Multi-Factor Authentication

Even if passwords are stolen, multi-factor authentication provides an additional layer of protection. Authentication applications, security keys, and biometric verification can significantly reduce unauthorized access.

3. Email Filtering and Monitoring

Organizations should use email security tools that can detect malicious links, block suspicious attachments, and identify spoofed email addresses before they reach employees.

4. Strong Password Policies

Employees should use unique passwords, password managers, and appropriate password policies. Compromised credentials remain one of the primary goals of phishing campaigns.

5. Incident Response Planning

No organization can completely eliminate cyber risk. Managers should ensure there are clear procedures for reporting phishing attempts, isolating compromised accounts, investigating incidents, and recovering affected systems.

Security is a Management Issue

One of the most important lessons from information systems security is that cybersecurity is not solely an IT responsibility. Managers influence budgets, policies, staff training, risk management, and business continuity planning.

Technology alone cannot protect an organization if employees are unprepared or if management fails to prioritize security. Effective cybersecurity requires leadership, awareness, and continuous commitment.

Personal Reflection

Before studying cybersecurity, I viewed security primarily as a technical issue managed by IT departments. However, researching phishing attacks has demonstrated that cybersecurity is equally a management challenge. Human behaviour, organizational culture, training, and leadership decisions all influence an organization's security posture.

This has reinforced my understanding that effective information systems management requires balancing technology, people, and processes to reduce organizational risk.

Conclusion

Phishing remains one of the most dangerous cybersecurity threats because it exploits human behaviour rather than technical vulnerabilities. While organizations continue to invest in sophisticated security technologies, attackers often succeed through simple deception.

The most effective defence combines technology, policies, training, and management support. Organizations that educate employees, implement multi-factor authentication, maintain strong security procedures, and prepare for incidents are better positioned to reduce the impact of phishing attacks.

References

• Cisco (2021) What is a cyberattack? Available at: https://www.cisco.com/site/us/en/learn/topics/security/what-is-a-cyberattack.html
• Mallach, E.G. (2020) Information Systems: What Every Business Student Needs to Know. 3rd edn. New York: McGraw-Hill Education.
• SonicWall (2026) Worldwide Attacks Live. Available at: https://securitycenter.sonicwall.com/m/page/worldwide-attacks