SecurityRingBook a Demo

Glossary

What is spear phishing?

Phishing aimed at a specific person, team or organisation, using details about them to make the message persuasive.

How it works

The UK NCSC explains that, unlike mass campaigns sent to millions of inboxes, targeted campaigns use information about your employees or company to make messages more persuasive and realistic; this is usually called spear phishing. It notes that staff who handle sensitive information, money or IT systems are of greater interest to attackers.

A real example

The FBI’s May 2025 warning describes texts and AI-generated voice messages aimed at current and former senior government officials and their contacts. The FBI notes that smishing and vishing use tactics similar to spear phishing, which uses email to target specific individuals or groups.

How to train for it

  • Expect attackers to know your name, manager and projects; those details are no evidence a message is genuine.
  • Be most careful with requests touching money, credentials or data.
  • Train the teams most likely to be targeted with scenarios that fit their work.

SecurityRing personalises each simulation email with the employee’s name, department and manager, and recommends scenarios from your industry and company news.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. UK National Cyber Security CentrePhishing attacks: defending your organisationAccessed 17 October 2026.
  2. FBI Internet Crime Complaint CenterSenior US Officials Impersonated in Malicious Messaging Campaign (PSA I-051525-PSA)Published 15 May 2025 · Accessed 17 October 2026.