Phishing attacks incorporate a range of different methods and tactics to increase the likelihood of the recipient taking action that will harm the organisation. Awareness training like Sophos Phish Threat teaches people to spot the phishing emails that do get through.
Before today’s sophisticated phishing scams, the world was introduced to the notorious ‘Nigerian prince’ who needed money. Has he moved on from our mailboxes, or just become cleverer?
Phishing is Africa’s most prevalent form of cyberattacks, accounting for around one-third (roughly 34 percent) of all detected cyber incidents on the continent. That’s according to the INTERPOL Africa Cyberthreat Assessment Report 2025.
But what is phishing and how can cyber security teams take measures to protect against it? The combination of educating users themselves to be more aware, together with built-in email security measures, is proven to be an effective combination.
‘Nigerian Royalty’ Needing a Little Help
Most of us are aware of the ‘Nigerian prince’ scam, which starts with an intriguing email from the ‘prince’ himself, saying he needs a little assistance securing his fortune and promises a handsome reward in return.
This assistance involves you sending him money or revealing your banking details. The ‘prince’ then takes the money and runs – or, in worse cases, keeps up the lie and tries to scam you again or steal your identity.
Today, the ‘prince’ isn’t as prevalent in our mailboxes as he used to be, but the scam has become more sophisticated. Phishing messages today typically impersonate trusted entities (rather than fake princes) and try to deceive users with legitimate-looking communications.
Thinking that they’re interacting with a known, safe or legitimate actor, phishing attacks make users inadvertently share sensitive information, open unsafe links or download malicious files. This offers an entry point for broader attacks through compromising user accounts or delivering malware – and once a hacker has infiltrated your network with a nasty strain of malware, you are essentially at their mercy.
Phishing attacks incorporate a range of different methods and tactics to increase the likelihood of the recipient taking action that will harm the organisation. These can include:
- Imitating other trusted users, or recreating the branding and design of known companies;
- Using messaging that creates a sense of urgency, prompting the recipient to act quickly without critically evaluating the authenticity; and
- Taking a more targeted and researched approach to develop personalised messages for specific recipients, known as spear phishing.
Long story short: the Nigerian Prince hasn’t really gone away. ‘He’ has just become cleverer.
Phishing Is Still Making Headlines
While the ‘Nigerian prince’ has apparently retired, he has today been replaced with far more sophisticated phishing-style attacks, which make global headlines and cost real money.
In February 2024, European retail group Pepco disclosed that its Hungarian business had lost around €15.5 million after a convincing phishing email, made to look as though it came from a legitimate employee, tricked finance employees into authorising an urgent payment.
A similar scam cost Toyota Boshoku Corporation, a Toyota group supplier, around $37 million in 2019, after fraudulent emails convinced employees at its European subsidiary to redirect a large wire transfer to attacker-controlled accounts.
Neither attack needed an initial pathway of sophisticated malware or a hidden system vulnerability – just a convincing email and a moment of misplaced trust.
Stopping Phishing Before It Reaches the Inbox
Awareness training like Sophos Phish Threat teaches people to spot the phishing emails that do get through. But the strongest defence stops as many of them as possible before they ever land in an inbox – which is where Vox Business’s email security offering, powered by Sophos, comes in.
With 94% of breaches reported to start with a malicious email, the Sophos Email solution combines more than 20 AI and machine learning models with the Sophos X-Ops threat intelligence database to filter out phishing, business email compromise, malware and domain-spoofing attempts before delivery, and to automatically retrieve and delete any malicious message that slips through afterwards.
Links are re-checked at the moment someone clicks them, sensitive data is blocked from leaving via built-in data loss prevention, and SPF, DKIM and DMARC checks confirm that senders are who they claim to be.
It also builds in its own phishing simulations and security awareness training, all managed from a single Sophos Central dashboard, plus a standby inbox to keep email running during an outage. Further, it slots in alongside Microsoft 365 or Google Workspace, with no migration and no MX cutover stress.
Find out more about Vox Business’s Email Security solution.
Why People-First Security Matters
Technology stops a huge number of threats, but the single biggest risk to most organisations remains the end user. These warning stories remind us firsthand how the attacks began with malevolent emails, after which unwitting click-throughs led to compromised credentials and the sly deposit of crippling malware on the system.
Sophos Phish Threat treats employees as part of the defensive fabric by creating repeatable, safe practice through simulation and education. The result is measurable behaviour change, better reporting and a genuinely smaller human attack surface for your organisation.
Sophos is a recognised leader in endpoint and network security solutions, while Vox is an accredited Sophos Platinum partner and is certified to implement, manage and support Sophos solutions across the product stack. We offer local, South African-based support with business-focused service levels.
Activate your human firewall today.
Talk to your Vox Business account manager for a tailored quote and a recommended pilot that reflects your industry risk profile.
Contact: New Business Sales (JHB) +27 (0) 87 805 0500, or email: info@voxtelecom.co.za
FAQs
What is Sophos Phish Threat?
Sophos Phish Threat is a cloud-based security awareness platform that runs realistic phishing simulations and delivers automated, on-the-spot training to anyone who fails a simulated attack. It helps organisations reduce phishing susceptibility and build a human firewall.
How does the training get delivered?
Anyone who clicks in a simulated phishing campaign is automatically enrolled in a short, interactive training module relevant to the lure. Training is delivered immediately to reinforce learning at the moment of error.
Can Sophos Phish Threat be customised for my industry?
Yes. The platform offers a custom campaign builder and industry-relevant templates so you can tailor campaigns and training modules to specific teams, departments or threat profiles.
How is success measured?
Success is measured through dashboard KPIs, including click rates, report rates, training completion and trend analysis over time, which show reductions in employee susceptibility and improvements in reporting behaviour.
About Author
