- Published
- Source
- Cofense
- Filed under
- Phishing & scams
- Technique
- T1566 Phishing (opens in a new tab)
Lee Martin explores why security awareness programs need to move beyond measuring activity and risk to focus on whether employees are actually getting better at recognizing and responding to phishing. Cofense’s approach to Secure Behavior Management connects measurable employee competency with real-world phishing and remediation signals, giving organizations a clearer picture of what employees know,…
Spotted a scam?
- Forward suspicious emails to report@phishing.gov.uk – the NCSC uses the reports to take scam sites down.
- Forward scam texts to 7726, free on most UK networks.
- Never share a one-time code, and check any request for money by calling a number you already trust.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst · Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst · Email & Phishing Investigation
Someone will report this email. Know exactly what to do next.
Analyse a reported phishing email properly: headers, message trace and quarantine, what SPF, DKIM and DMARC failures tell you, and the indicators that make it business email compromise.
- Header forensics and message trace
- SPF, DKIM and DMARC failures explained
- Spotting business email compromise
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
