The Workforce Has a Blind Spot, and It's Ringing
KnowBe4, Thursday, September 10th, 2026
As email defenses improve, attackers are moving to the phone, where almost no organization trains or monitors.
KnowBe4 argues that improving email defenses have pushed attackers toward voice, where organizations have almost no controls: no filtering, no logging and typically no training.
Recent campaigns targeting Microsoft 365 through help desk impersonation calls bear this out. The asymmetry is stark, since a decade of investment in email security has no counterpart on the phone.
The practical recommendations centre on verification procedures that do not rely on information an attacker can research, and on treating inbound IT calls as inherently unverified.