What is Phishing?
Phishing is a social-engineering attack that tricks an employee into clicking a malicious link, opening an infected attachment, or handing over credentials by impersonating a trusted sender.
Phishing remains the #1 entry vector for cyber incidents at small businesses in 2026. Variants include spear-phishing (targeted at specific individuals using research), whaling (targeted at executives), business email compromise / BEC (impersonates a known vendor or executive to redirect payments), and SMS phishing (smishing).
Modern phishing uses lookalike domains, AI-generated copy that matches the impersonated sender's style, and sometimes valid HTTPS certificates on the lookalike domain. The 'check the URL' advice from 2018 isn't sufficient.
Defenses are layered: email-gateway filtering, DMARC/SPF/DKIM on your sending domain, MFA so credential theft alone isn't enough, security awareness training, and phishing simulations to identify staff who need extra help.
Why it matters for Florida small business
BEC scams targeting Florida small businesses average $50,000+ per incident in 2026. Most start with a single phishing email to bookkeeping or HR.
What to do
Run a phishing simulation this quarter using a free tool like KnowBe4's free phishing test or Microsoft Defender Attack Simulator, then route staff who clicked through targeted refresher training.