The Confidence Gap
Research found that 86% of employees feel confident they can identify a phishing email. Yet more than half of those same employees admit to having fallen victim to some form of scam. The gap between confidence and actual performance is one of the most exploitable vulnerabilities in any business.
Employees who believe they are too savvy to be tricked are less likely to pause and verify before acting. They skip the double-check on a link, assume an urgent payment request is genuine because it looks familiar, and trust their instincts over process. That confidence is exactly what modern phishing attacks are designed to exploit.
How Attackers Target Overconfident Staff
Phishing has moved well beyond obvious scam emails. Current attacks include emails appearing to come from your bank or a regular supplier, requesting urgent verification or payment. Fake invoices formatted to match documents your team sees every day. Messages apparently sent by a colleague or senior member of staff, using details gathered from social media or previous correspondence.
These are crafted to pass the casual glance of someone who thinks they know what a scam looks like. The employee who says “I’d never fall for that” is often the one who does, because they do not apply the caution that doubt would prompt.
What Businesses Can Do About It
Regular, practical awareness training
Training needs to go beyond a one-off session. Phishing techniques change regularly, and awareness needs to keep pace. Practical exercises that simulate real attack scenarios are more effective than theoretical briefings. When staff experience a convincing fake phishing email in a safe environment, it recalibrates their confidence more effectively than any presentation can.
Build a reporting culture
If staff are concerned about looking foolish for reporting a suspicious email, they will not report it. Creating a culture where raising a concern is welcomed, not criticised, means incidents get flagged before damage is done. Speed of reporting is one of the most important factors in limiting the impact of a phishing attack.
Technical safeguards as a backstop
Email filtering, multi-factor authentication, and conditional access policies reduce the success rate of attacks when human vigilance lapses. These tools do not replace awareness but they provide a second line of defence when a staff member makes a mistake.
Support Across the North West
Blowfish Technology provides cyber security awareness training and managed security services across the North West, including IT Support Blackburn, IT Support Crewe, and IT Support Birkenhead.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.