A company has gone through a round of phishing attacks. More than 200 users have had their workstation infected because they clicked on a link in an email. An incident analysis has determined an…

Antivirus may detect known malware signatures but can be bypassed by novel or obfuscated executables and does not prevent users from clicking phishing links.

Patch management reduces exploit risk against known vulnerabilities but does not prevent users from voluntarily executing malicious files delivered via phishing.

Log monitoring is a detective control and alerts after compromise has occurred; it does not prevent the phishing click from happening.

Application whitelisting prevents unauthorized executables but does not address the upstream human behavior that initiated the attack.

The attack chain began with users clicking a link in a phishing email, a behavior that technical controls alone cannot fully prevent. Security awareness training directly addresses the root cause by educating users to recognize phishing attempts, reducing the likelihood of initial click-through and breaking the attack chain before any payload executes.