The Evolving Threat of Email Phishing: Insights from Security Experts

Email phishing attacks have been a persistent cybersecurity threat for years – and this is rapidly evolving. According to IBM’s Security Report, the threat rose at a staggering rate of 202% in the second half of 2024, driven by AI and increased email usage. 

To understand this alarming trend, we spoke with Sam an Account Manager for cybersecurity firm Pentesec, a sister company of  Symity.

We explore the evolution in email phishing and detail steps you can take to protect your enterprise. 

AI’s Dual Role in Email Security 

AI is a major driver in the increased phishing threat, making it easier to create convincing emails. The rise of remote work during the COVID-19 pandemic has also contributed, as email has become the preferred communication method for many organizations, opening users to further vulnerabilities.  

“AI is a huge driver behind the increase in phishing attacks. It makes it far more accessible for attackers to create mass emails that look more human than ever before.” – Sam, Pentesec 

However, the targets of these attacks are often not the IT teams tasked with security. “The target is your day-to-day users – the insurance sales guys, the marketers – not the people who understand the ins and outs of security,” said Sam. This disconnect means many employees struggle to identify sophisticated phishing attempts. 

Sam noted that while regulations like GDPR have helped improve security in some sectors, the challenge of email threats remains difficult to regulate. “You can’t avoid it – as long as I have your email address, I can send you an email from wherever I like.” 

The experts agreed that a multi-pronged approach is needed. Organizations should start by evaluating their current email security tools and policies. “Come talk to us, and we can do a 14-day validation to show you what’s getting through and what we can stop,” Sam suggested. 

Organizational Approach to Email Security 

Sam detailed his suggestions for how organizations should approach email security, recommending:

1. Start with understanding current protections and their effectiveness  

Do you have a dedicated tool? If so, Bourike recommends: “Evaluate that, understand what it’s doing, how well it’s working, and then I’d say just be open to what the market has to offer.”

2. Consider trials of advanced tools for validation and gap analysis 

Some tools have free trials, including a 14-day trial for Check Point’s Harmony Email Security Solution

3. Foster a security-aware culture through regular training and risk communication 

Creating a security aware culture is key – one person cannot operate safely in a vacuum. “Training your staff regularly and highlighting the risks is key to building that internal security culture,” emphasizes Sam. 

From a global lens, he adds: “I think security is a culture and people have different beliefs around that depending on where you are how you were brought up how you were introduced into the industry.” He sees huge variations in approaches between countries, noting that the UK is quite advanced while places like the Netherlands are only just taking security seriously. 

4. Implement strict policies on device usage (corporate vs. personal) 

More flexible working patterns have heightened the challenge of keeping an overview of employees’ overall device usage. Workers operating from home or in hybrid patterns may switch between corporate and personal devices – particularly as some companies expect an ‘always on’ culture.  

Sam recommends being a “little bit cutthroat” and asserting to employees: “if you’re going to access organisation data then you need to be doing it on a corporate laptop or a corporate mobile.” They can back this up with configurations that block access to corporate data from personal devices. 

5. Recognize security as an essential “insurance policy” for data protection 

Bourike recommends that companies view security as an expensive but necessary insurance policy: “at the end of the day it’s the most important insurance policy that an organisation could deploy because that data is the most valuable thing to an organisation.” 

As the threat of email phishing continues to evolve, organizations must remain vigilant and proactive in their approach to cybersecurity. The experts agree that a comprehensive strategy combining advanced security tools, like Check Point’s Harmony Email Security solution, and a strong culture of security awareness is essential. 

“Security is a cat and mouse game – you have to be right 100% of the time, while the attackers only need to be right once,” said Sam. “That’s why it’s so difficult, and why security will always be a constant challenge.” 

By empowering employees to recognize and report suspicious emails, and deploying robust email security measures, organizations can better defend against the rising tide of phishing attacks. With the right combination of technology and human awareness, businesses can stay one step ahead of cybercriminals and protect their most valuable assets. 

Find out more about Symity and Pentesec.