Phishing is not a single technique — it spans a spectrum from mass-produced, generic campaigns to highly researched, individually crafted attacks. Understanding where your organisation sits on that spectrum, and testing resilience at both ends, is essential for building effective defences.

Bulk phishing

Bulk phishing is the volume game. An attacker sends thousands or millions of emails with a generic pretext — a fake delivery notification, a password expiry warning, a tax refund, or a subscription renewal. The emails are identical or nearly so, with no personalisation beyond the recipient’s email address.

The success rate of any individual email is low — perhaps 1–3% — but when sent at scale, even a small percentage yields a significant number of compromised accounts. Bulk phishing is the digital equivalent of casting a wide net.

Characteristics of bulk phishing:

  • Generic pretexts not tailored to the recipient.
  • Sent to large numbers of addresses, often harvested from public sources or purchased lists.
  • Low effort per email, high volume.
  • Relies on basic human responses: curiosity, fear, urgency.
  • Often caught by email filters, but enough gets through to be effective.
  • Typically aims for credential harvesting or malware delivery.

Bulk phishing is the type most employees have been trained to recognise. The spelling errors, the unfamiliar sender, the suspicious link — these are the warning signs that awareness training focuses on.

The problem is that training against bulk phishing creates a false sense of security. Employees who can spot a generic phishing email may be completely unprepared for a targeted attack.

Spear phishing

Spear phishing is the targeted approach. The attacker selects a specific individual or small group and crafts an email designed specifically for them. The pretext is built on research — OSINT gathered from LinkedIn, the company website, social media, and other public sources.

A spear phishing email might reference:

  • A real project the target is working on.
  • A genuine colleague or business partner.
  • An upcoming event the target is attending.
  • A recent transaction or communication.
  • Industry-specific terminology and processes.

The email looks legitimate because it is built from legitimate information. The sender address may be spoofed to match a known contact, or a lookalike domain may be used. The tone and style match what the target would expect from the apparent sender.

Characteristics of spear phishing:

  • Highly personalised, referencing specific details about the target.
  • Sent to a single person or a small group.
  • High effort per email, low volume.
  • Exploits trust and familiarity rather than generic urgency.
  • Much harder for email filters to detect because it lacks the obvious indicators of bulk phishing.
  • Often targets individuals with high-value access: executives, finance, IT administrators.

The success rate of spear phishing is dramatically higher than bulk phishing — studies consistently show rates of 20–50%, compared to 1–3% for generic campaigns. And because it targets high-value individuals, the impact of a single successful email can be severe.

Business email compromise

At the extreme end of the spear phishing spectrum sits business email compromise (BEC). In a BEC attack, the attacker impersonates a senior executive or trusted business partner and instructs the target to take a specific action — usually transferring funds or sharing sensitive data.

BEC attacks are often text-only (no links, no attachments, no malware) which makes them invisible to most technical email filters. They rely entirely on the target’s trust in the apparent sender and the authority of the request.

BEC has consistently been one of the most financially damaging forms of cyber attack. The FBI’s Internet Crime Complaint Center has reported billions in losses from BEC globally, far exceeding the losses from ransomware.

Why testing for both matters

Organisations that only test against bulk phishing are measuring their resilience to the least sophisticated form of attack. The threat landscape includes both:

  • Opportunistic attackers running high-volume campaigns looking for any organisation with weak defences.
  • Targeted attackers who have identified the organisation as a specific target and will invest time and effort into crafting convincing attacks.

A comprehensive phishing assessment programme should test resilience at both ends of the spectrum.

Multi-wave escalation

An effective approach is to run escalating campaigns over the course of an engagement:

Wave 1: Bulk-style campaign. A generic pretext sent to all employees. This establishes a baseline and tests resilience to the most common type of phishing.

Wave 2: Targeted by role. Emails tailored to specific departments or functions, using pretexts relevant to their work. This tests whether awareness varies across the organisation.

Wave 3: Spear phishing. Individually crafted emails targeting high-value individuals, built on OSINT. This tests resilience to the most dangerous form of phishing — the type a real attacker would use against the people with the most valuable access.

Each wave produces different data:

  • Wave 1 tells you how resilient the general population is to commodity phishing.
  • Wave 2 tells you whether high-risk teams (finance, IT, HR) have stronger defences.
  • Wave 3 tells you whether your most targeted individuals can be compromised by a determined attacker.

Defending at both ends

The defences against bulk and spear phishing overlap but are not identical.

Against bulk phishing:

  • Email filtering and spam detection.
  • Link and attachment scanning.
  • Awareness training focused on recognising generic phishing indicators.
  • A “report phishing” button in the email client.

Against spear phishing:

  • Verification procedures for sensitive requests (especially financial transactions and credential changes).
  • DMARC, SPF, and DKIM to prevent sender address spoofing.
  • Domain monitoring for lookalike domains.
  • Awareness training that goes beyond “don’t click suspicious links” to include recognising well-crafted, personalised attacks.
  • A culture where it is normal to verify requests through an independent channel, even when they appear to come from a trusted source.

Against BEC specifically:

  • Multi-person approval for financial transactions above a threshold.
  • Mandatory verbal confirmation for changes to bank details or payment instructions.
  • Training specifically focused on BEC scenarios.

No single control stops all phishing. But by understanding the spectrum — from bulk to spear to BEC — and testing against the full range, organisations can build defences that are proportionate to the actual threat.