Phishing Attacks: What They Are, Why They Matter and How Your Organization Can Protect Itself Against Them

by | Aug 1, 2019 | Blog

Phishing attacks are one of the biggest cyber threats facing small and midsized organizations at the moment. Reports of Phishing attacks have grown by around 65% over the last year, and 76% of businesses have reported to have been the victim of a phishing attack.

Phishing attacks can be hugely damaging, and are very difficult to effectively counter, for even the largest organizations. This article will take you through how phishing attacks, why they are so successful, and how you can use IRONSCALES, a powerful cyber security tool aimed at small and medium sized businesses, to protect themselves from phishing attacks.

What are Phishing attacks?

Phishing attacks are currently the number one cyber threat facing businesses of all sizes. Phishing attacks are the crime of deceiving people into sharing sensitive information such as account details, and credit card numbers. For businesses, these types of attacks are very difficult to effectively combat. It’s easy for an attacker to imitate a business contact or client using information they have taken from LinkedIn. People are often very busy at work, and so may not be as conscientious about checking an email is legitimate as they would be for their own personal email accounts. It is also very difficult for email security technologies to spot phishing attacks, as they often don’t contain any harmful information for filters to spot, but instead target the human level weakness in an organization.

There are multiple different variations of phishing attack. The most common is the standard phishing email. This is usually fairly easy to spot, but they are becoming increasingly sophisticated. These emails can be blackmailing attempts, fraudulent emails asking users to reset passwords, and fraudulent payment requests. The sheer number of these attacks that organization’s receive, and their increasing convincingness, mean they are a huge threat to organizations. They are also becoming increasingly automated, as attackers are able to send out hundreds of these articles to small and midsized companies, looking for a response.

More sophisticated phishing attacks include spear-phishing and business email compromise. Spear Phishing occurs when an email arrives from a trustworthy source, but instead takes the unknowing recipient to a fraudulent website which is loaded with malware. These emails are usually very targeted, asking users to open their updated payslip, for example. Business Email Compromise attacks are more advanced again. They usually involve phishing campaigns aimed at high level executives within a company, such as the CEO, to gain access to their account information and passwords. Attackers will then use this information to send phishing emails from the compromised account, which have a very high likelihood of convincing employees to make a fraudulent payment.

Why they are so effective against small and mid-sized companies 

Small and midsized companies are particularly at risk from phishing, spear phishing and business email compromise attacks for three major reasons.

  1. A Busy Working Environment

Small businesses are normally busy working environments, with employees that don’t have time to become cyber experts. Because of this, phishing emails have a much better chance of not being reported or being clicked on by an unsuspecting employee. Attackers know that it’s unlikely small businesses will think themselves as being at risk from a phishing attack, and so see them as weaker targets. Due to the increasing automation of phishing attacks, small companies can be targeted by hundreds of attacks in a short space of time. 

  1. Less Aware of the Risks

Attackers know that small and mid-sized businesses are unlikely to have undergone comprehensive Security Awareness Training, and so employees are more likely to fall for a phishing attack. Many employees in small business will be unaware of the risks that fraudulent emails can pose and will likely not see themselves as targets for attack. However, case studies have shown that small businesses are a very lucrative target for attacks. Even the smallest company can still deal with large amounts of money, or customer data, and they can also be a backdoor into targeting larger companies that they do business with.

  1. No Technological Defences

Attackers know that most large companies will have spent a lot of money implementing advanced cyber security products to protect themselves from all kinds of cyber threats, including phishing attacks. Because of this, attackers view small and midsized companies as much easier targets. They are much less likely to have a strong technological defence in place to remediate against phishing attacks, and so are far more open to attack than larger companies. 

Why businesses need to be protected against attacks 

Being successfully hit by a phishing attack can be hugely damaging for small and medium sized businesses. The most obvious impact is financial. According to IBM, the average cost of a data breach is $3.86 million. Once attackers gain access to accounts and passwords, they are often able to uncover payment information and bank records, which they can use to make fraudulent payments. In addition, successful targeted phishing attacks often target employees directly, with requests for payments, which may often look exactly like legitimate business expenses. Even companies such as Facebook, Apple and Google have massively suffered from this type of attack.

Phishing attacks can also put employee and customer data at risk. Gaining access to customer and employee data, as well as the data from contacts in larger companies, is hugely valuable to attackers. Selling private data is extremely lucrative, and small businesses can hold private data over thousands of their customers and employees. Hackers can also use account data to perpetrate more phishing attacks. Under GDPR, businesses are held liable when they suffer a data breach which can also cause huge financial losses for small businesses.

Attacks also damage business reputation. Even small and medium sized businesses can find it difficult to recover from the negative press of losing customer data, which can be one of the most damaging long term effects of being hit by a successful phishing attack.

How To Protect Your Organization Against Phishing Attacks with IRONSCALES

IRONSCALES is a market leading post-delivery protection solution, which provides businesses with comprehensive protection against phishing, spear-phishing and business email compromise attacks. This protection covers both technological defences INCLUDING anti-malware scanning, email filters and the human element of defence, with Security Awareness Training and testing.

Allowing Users to Report Phishing Attacks

To help organizations remediate against phishing attacks, IRONSCALES allows you to implement a ‘Report Phishing’ button directly within the users inbox. This means that when someone receives an email that they believe could be suspicious, they can report it as a phishing attack straight away. When an employee does this, a warning banner will display for everyone else who received the same email, helping to mitigate the risks of a successful phishing attack. Admins also get notified when an email has been reported and can then delete the email from the inbox of anyone who received it, if necessary. This is an important feature to stop the spread of phishing attacks. 

Anti-Virus Scanning and Threat Scoring

To help admins more accurately determine if an email is a phishing attack, IRONSCALES provides a probability of threat score. This is based around malware scanning from multiple leading anti-virus engines, as well as using machine learning to scan contextual elements such as the location the email came from, the time it was sent and the emails contents. This allows admins to get a clearer picture of the threat and decide what course of action to take. If a link within an email is determined as malicious, that email is automatically flagged, and the response is automated Admins can also mark emails as a ‘false positive,’ which removes the warning banner placed on all emails, quarantine emails, or simply delete emails from all user inbox. The ability to have this control over emails, after they have already entered the email inbox, is what puts IRONSCALES above its competitors.

Warning banners when other companies have reported emails

IRONSCALES also displays warning banners on email that other companies have designated as a threat. Using Themis, a threat intelligence network, IRONSCALES automatically places warning banners on phishing emails that other organizations have already seen as harmful. This helps to stop the spread of harmful phishing emails and protects employees from known threats. This provides rapid protection against phishing threats. 

The ability to report internal emails to stop business email compromise  

As well as being able to report external phishing emails, IRONSCALES allows user to report users from within their own organization as phishing attacks. This allows businesses to effectively combat business email compromise attempts, as users can quickly and easily report an email as being suspicious. This then displays a warning banner on all of the emails being sent from that account, which will reduce the likelihood of an attacker being able to pressure employees into giving up account details or passwords.   Admins can then quickly quarantine the compromised account and remove any harmful emails that may have been sent.

Security Awareness Training

IRONSCALES also provide Security Awareness Training, an important tool to help organizations empower their employees to spot phishing attacks and report them to admins. Using IronSchool, you can test your employees by sending out simulated phishing emails, which are fully customizable. You can break down this testing by employee segments, and can set difficulty levels for different users. This helps to give organizations a picture of how exposed you are as an organization to phishing attacks, and how proficient your employees are at stopping them.


You can get started with a Free Phish test here:


IRONSCALES also provides Security Awareness Training content, which is gamified and interactive to help employees learn security topics and best practices. This is vital to empower employees to recognise what a phishing attack looks like, how to report it, and what the potential risks they pose are.  Find out more about IRONSCALES Security Awareness Training here:


Phishing attacks are the number one threat facing small and midsized businesses at the moment. IRONSCALES provides comprehensive detection, remediation and protection against phishing attacks, which will put your organization at an advantage against attacks and help to ensure that your data employees and customers are protected.

To find out more about IRONSCALES and how it can help your organization, speak to one of our sales team at or visit this link:



Related Articles

Read More