What are the most common mistakes companies make when protecting themselves against phishing?

A positive trend — but with serious gaps

We are currently seeing a positive trend in employee cybersecurity education. More and more companies are introducing various forms of training, awareness programs, and security initiatives aimed at increasing employees’ understanding of cyber risks.

Both companies and their employees are increasingly aware that cybersecurity plays a critical role not only at work but also in everyday life.

However, from our experience, especially in small and medium-sized businesses, the format or content of these training programs is often poorly designed. As a result, they frequently create a false sense of security, while delivering little to no real benefit.

False security: Training without testing doesn’t work

Many organizations today offer some form of security training, whether it’s e-learning modules, short presentations, or mandatory annual sessions. In practice, however, we often see that this knowledge is never tested in realistic scenarios.

Only after running a simulated phishing campaign do many companies realize with some shock, that despite regular training, a large number of employees still enter their credentials into a phishing form. In some cases, the only people who didn’t do so were those who happened to be on vacation or out sick.

The AI revolution in phishing

Another common challenge is that companies which until recently maintained a relatively high level of security awareness have not reacted quickly enough to new threats related to AI.

With the rise of artificial intelligence, phishing phone calls are becoming far more convincing, something we’ve observed firsthand in testing scenarios with several clients.

In practice, phishing is increasingly multichannel combining email attacks with smishing (SMS) and vishing (phone calls). This coordinated approach can increase the success rate of a simulated phishing campaign by dozens of percent.

A systematic approach is key to protection

To summarize: while mistakes can never be completely eliminated, what truly matters is a systematic approach to security.

Training employees alone is not enough. Organizations must regularly test employees, measure the effectiveness of training, and continuously adapt their defenses to evolving threats.

Only then can phishing protection become truly effective, not just a compliance checkbox.