Phishing remains the attackers' favourite way in. It does not target a technical flaw but trust: a credible message, a sense of urgency, and one click is enough.

Signs to check

  1. The sender: the display name looks familiar, but the real address does not match the official domain.
  2. Urgency: "your account will be suspended in 24 hours", "overdue payment".
  3. The link: hover without clicking; is the address shown the right one?
  4. An unexpected attachment, especially an archive or a document asking to enable macros.
  5. A request for a password, an SMS code or a bank transfer.
  6. An unusual tone from a colleague or a manager.
  7. Mistakes and sloppy layout (less and less common with AI).

A legitimate service will never ask for your password by e-mail.

Golden rule from our training

You clicked? Act in this order

  1. Disconnect the computer from the network (cable and Wi-Fi) without shutting it down.
  2. Alert your IT department or your CISO immediately.
  3. Change the affected password from another device.
  4. Report the message to protect your colleagues.

Our awareness campaigns simulate these attacks in real conditions and measure your teams' progress, campaign after campaign.

Back to articles