Hybrid work wasn’t designed to make us unsafe, but it’s doing a pretty good job of that.
The average hybrid employee switches between nine apps a day, jumps between work and home Wi-Fi, and spends hours in back-to-back video calls while checking messages across Slack, WhatsApp, Outlook, and browser tabs.
It’s the perfect storm for mistakes. When those mistakes involve suspicious links or fake login pages, they quickly turn into breaches.
That’s why 74 percent of data breaches today involve a human element, mostly through phishing, credential theft, and other human error cybersecurity incidents. The rise of remote work has just amplified everything.
The Growing Phishing Risk for Remote Teams
In terms of security risks, phishing is old-school. It’s been around since the 90s. So why are we still falling for it? Because phishing today doesn’t look like it used to.
Modern attacks are personalized, AI-generated, and incredibly convincing. You’re navigating invoices from vendors your team actually works with. Deepfake voicemails mimicking your CFO. Or Zoom meeting invites spoofed with malicious links.
Worse still, it’s getting easier to launch attacks. Consumer AI tools like ChatGPT can craft near-perfect phishing emails in seconds. Shadow IT platforms, where employees paste confidential data into unsanctioned tools, introduce huge vulnerabilities. Plus, off-channel messaging (SMS, WhatsApp, personal Gmail accounts) means IT can’t monitor or block attacks in time.
Even defenses like MFA are being outpaced. So-called MFA fatigue attacks (like the Uber breach) exploit users’ habit of approving login requests without thinking, especially on mobile.
So if you’re wondering how to combat phishing in today’s world, it’s not enough to block odd emails. You need to change behavior by embedding security awareness training into the hybrid work culture itself.
How to Combat Phishing: Best Practices for Hybrid Teams
Getting people to stop clicking bad links isn’t about scaring them. It’s about training them to behave like members of the security team, because they are.
That means ditching checkbox compliance and building an ongoing culture of cybersecurity training for employees, especially in hybrid work environments where people are juggling devices, channels, and logins all day.
Ongoing, Contextual Training
You’ve seen the compliance courses. Ten slides. One quiz. Zero impact. That might’ve been enough when everyone was on the same network, in the same office. But today? With people working from coffee shops, bedrooms, and airports, you need more than a PowerPoint to build security muscle.
Modern cybersecurity training for employees isn’t an annual checkbox. It’s continuous. and it happens where people work, not in a separate LMS that they forget exists.
Real-time, contextual learning is taking over, with phishing simulations tailored to hybrid schedules or micro-lessons that pop up when someone makes a risky choice on Outlook.
Behavior-Based Nudges
In the hybrid workplace, people aren’t making risky decisions because they’re careless. They’re just moving fast, juggling tasks, and getting pinged on six apps at once. Learning how to combat phishing and human error means moving from just “more training” to regular reminders.
Behavioral nudges work because they meet users in the moment. An AI-powered message that says, “This document contains sensitive info, double-check before sharing.” Or “This link comes from outside the org, do you trust it?”
You can build nudges into email, chat, file sharing, and even apps like Zoom and Teams. Microsoft’s Copilot is starting to do this with just-in-time security cues, and you’ll see more UC integrations roll out these features, too.
Just-in-Time Access + Role-Based Restrictions
When it comes to human error in cybersecurity, the most dangerous people aren’t always the ones with bad intentions. They’re the ones with too much access and not enough context.
That’s why companies are moving away from “default full access” and toward just-in-time access models. If a temporary contractor joins you for a 2-week sprint, don’t give them everything. Just give them what they need, for the exact time they need it, then revoke access automatically.
The same goes for new hires, cross-functional team members, and even executives who rarely touch technical systems. The fewer windows open, the fewer ways in. With tools for Zero Trust architectures and Unified Endpoint Management (UEM), you can automate most of this, provisioning, monitoring, and revoking in seconds.
