A company is the victim of a phishing and spear-phishing campaign. Users are Clicking on website links that look like common bank sites and entering their credentials accidentally. A security…

Spam filters inspect inbound email for phishing indicators such as spoofed headers, malicious links, and known-bad sender domains, preventing phishing messages from reaching end users before they can act on them. This serves as the primary perimeter control in a layered email security defense.

Host intrusion prevention systems monitor endpoint processes and network behavior for malicious activity but cannot intercept phishing emails or block a user from voluntarily submitting credentials to an external fraudulent site.

Client certificates provide mutual authentication between a known client device and a trusted server, but they do not prevent users from navigating to phishing sites and entering their credentials into fraudulent forms.

Content filters restrict access to known-malicious URLs, but newly registered phishing domains may not yet appear in filter databases, and the primary email delivery vector remains unaddressed by this control alone.

Log monitoring aggregates authentication and access events to detect anomalies - such as logins from unusual locations or times - that indicate credentials have been stolen. Early detection limits the dwell time of an attacker using harvested credentials, directly lessening the campaign's overall impact.

Data loss prevention policies monitor and block outbound transmission of sensitive data patterns, but they do not prevent a user from voluntarily typing credentials into a phishing site's form fields.