You trust your team. They’re sharp, experienced, and they know better than to click on shady links or open dodgy attachments… right?
They’ve been warned about phishing. They understand that cyber criminals craft convincing messages to fool even the savviest employees.
So, they wouldn’t fall for that kind of trick.
Or would they?
Confidence ≠ Caution
Here’s where things get risky. Feeling confident about spotting phishing scams doesn’t actually protect someone from falling for one. In fact, it can make them more vulnerable.
Recent studies show that while 86% of employees believe they could confidently identify a phishing attempt, more than half have already been victims of scams.
That’s a sobering thought.
These are people who knew the risks and believed they were immune – yet still got caught out. Why? Because phishing emails today are nothing like the old “Nigerian prince” scams. They’re sophisticated, well-designed, and incredibly convincing.
Modern Phishing is Hard to Spot
Cyber criminals now use tactics that are far trickier to detect:
- Emails that appear to come from trusted suppliers or financial institutions
- Fake invoices that look exactly like the real thing
- Messages that mimic a colleague’s writing style and tone
When someone assumes they’re too smart to be fooled, they often skip essential safety checks – and that’s when mistakes happen.
The Dunning-Kruger Effect in Action
This is a textbook example of the Dunning-Kruger effect: people with limited knowledge overestimate their ability. In cyber security terms, overconfidence can lead to carelessness. Employees stop questioning suspicious messages, stop hovering over links, and stop double-checking details.
And that’s when hackers get in.
So, What Can You Do?
The first step is to change the mindset. Cyber threats aren’t just a tech problem – they’re a people problem. Regular phishing awareness training is essential. It helps your team stay up to date with evolving scam tactics and teaches them to remain cautious, even if they think they know what to look out for.
But training isn’t enough on its own. It’s just as important to create an environment where employees feel safe to speak up. If they suspect something’s off, they should be encouraged to report it – not fear being blamed or embarrassed.
Vigilance Over Ego
Cyber security isn’t about being the smartest person in the room. It’s about staying alert, questioning the unexpected, and never assuming you’re immune.
Because the moment someone thinks, “That would never fool me”, is often the moment it does.
