Home / Insights / Phishing isn’t only a tech problem — it’s a staffing one

Phishing isn’t only a tech problem — it’s a staffing one

Cyber Security Awareness Month wraps up this week, and the thing that still catches most organisations out isn’t the malware. It’s busy people and thin staffing.

When there is no dedicated IT desk, or when the people who move money, stock, and supplier details are under pressure, phishing becomes a staffing problem as much as a technical one. A fake invoice, a “new bank details” email, or a spoofed order lands in the middle of a packed afternoon. The person who opens it is trying to keep the business moving, not hunting for red flags.

That is not a character flaw. It is a design problem. If your controls assume everyone has time to scrutinise every message, they will fail on the days you are short-handed — which is most days for many SMBs.

Why awareness alone is not enough

Training still matters. People should know what a suspicious message can look like. But awareness without process leaves the same person who is chasing a delivery or closing the month as the last line of defence. Attackers know that. They time messages for urgency and routine: payments, suppliers, “quick approvals.”

Poster campaigns and annual e-learning help set a baseline. They do not protect a finance inbox at 4:45pm when three genuine supplier emails and one fake one arrive in the same burst. The organisation needs friction in the right places — and permission to pause.

Technology closes a lot of doors — filtering, safe links, malware defence. Culture and clear processes close the rest, especially when teams are short-handed.

What works on the business side

These are the habits that consistently help, regardless of how fancy the security stack is:

• MFA on every account that matters — email, finance, ERP, admin portals. Stolen passwords should not be enough on their own.
• Verify bank and payee changes by phone — never by the same email thread that requested the change. Use a known number, not one from the message.
• Build checks into ERP and finance workflows — so one convincing message cannot change a payment on its own. Dual control beats heroics.
• Make it completely fine to say “I clicked something, can you check?” — before anyone feels embarrassed. Speed of reporting beats silent panic.

None of those require a huge security team. They do require leadership that prefers a delayed payment to a wrong one, and IT (internal or partnered) that makes MFA and mailbox protections the default rather than an optional upgrade.

Design for the busy afternoon

If you only harden systems for calm mornings, you will lose on chaotic Fridays. Ask whether a new starter or a cover colleague could follow the payment-change process without tribal knowledge. Ask whether reporting a suspected phish is easier than ignoring it. Ask who covers finance when the usual person is on leave — and whether their process still includes the phone check.

For organisations without a full-time IT function, this is where an external partner earns their keep: not only blocking malware, but helping you put MFA, mailbox protections, and sensible finance checks in place — and backing people when they raise a hand.

Cyber Security Awareness Month ends; phishing does not. The organisations that stay safer treat staffing reality as part of the threat model, not an excuse after the fact.