Phishing Defense in Depth

Every control you stack in front of the inbox has a bypass. DMARC does nothing against a lookalike domain the attacker actually owns. The gateway rewrites links, so the attacker weaponizes the page an hour after delivery when it is already inside. The sandbox detonates the attachment, so the attacker password-protects the zip. Plan for the phish that gets through, because one will.

Defense in depth here means stacking controls that fail differently, so no single bypass ends the story. Think of it as a set of independent chances to catch or contain the attack, not one wall you are betting the company on.

Start at the edge with authentication. SPF, DKIM, and DMARC at p=reject kill exact-domain spoofing, which removes the most convincing pretext an attacker has. That does not stop lookalikes like yourcompany-support.com, but it forces the attacker off your name and onto something a trained user can spot.

Filtering, rewriting, and detonation

The gateway is your bulk filter. It scores sender reputation, checks against block lists, strips known-bad attachments, and rewrites URLs so a click at delivery time and a click three hours later both route through an inspection proxy. Time-of-click rewriting matters because attackers flip a benign link to malicious after the message clears the initial scan.

Attachment sandboxing is the next layer. Suspicious files get detonated in an isolated VM where the platform watches for the behavior that signatures miss: a Word doc spawning PowerShell, a PDF reaching out to a fresh domain, a macro writing to disk. Microsoft calls this Safe Attachments, Proofpoint calls it TAP, the mechanic is the same. It buys you coverage on novel payloads at the cost of a short delivery delay.

None of that touches BEC, which carries no payload. For the text-only fraud you need impersonation detection that reads display-name tricks and lookalike domains, plus a hard business rule: any change to banking details or any wire gets verified by a phone call to a known number, never by replying to the email.

The user report button is a sensor

Users will click. Treat that as a fact and turn them into detection instead. A one-click report button, the Microsoft Report Message add-in or a PhishAlarm equivalent, sends the full message with headers straight to the SOC queue. Every report is free threat intel, often arriving before your automated tools have caught up on a fresh campaign.

Measure the report rate, not just the click rate. A team that reports the phish in two minutes is worth more than a team that never clicks but never tells you anything, because the report is what lets you purge the same message from forty other mailboxes before those people click.

Design for the click that lands

The last layer assumes the first ones failed. Phishing-resistant MFA is the single biggest lever: FIDO2 hardware keys and passkeys cannot be relayed to a fake login page the way a one-time code can, which is why they beat SMS and app OTP against real credential-harvesting kits. Least privilege means the compromised account cannot reach the crown jewels. Egress filtering and EDR mean the malware that does execute still has to get past the endpoint and out the door.

Stack it right and the attacker has to beat authentication, filtering, the sandbox, a trained reporter, phishing-resistant MFA, and least privilege in one shot. Any one of those holding turns a breach into an incident report.