Let that gel for a bit. The inventors of phishing simulations blocked COVID-19 themed PhishMe templates, yet our customers’ employees reported more real COVID-19 phish than anyone else. A Cofense theme for 2020 was shining a light on the phishing tactics that evade secure email gateway (SEG) detection. We published a stream of SEG bypass samples on our blog prompting many organizations to ask for help testing their email environments. With Managed Phishing Detection and Response (Managed PDR) delivered through the PDC, we’ve gained even greater insight into the phishing threat landscape. In fact, we have a larger pool of enterprise phishing threat intelligence data than anyone else in the world. What’s even more remarkable is getting to see firsthand that well-conditioned users report real phish quickly and that reduces overall risk to an organization. Credential-stealing campaigns account for over 50% of phish reported by end users to the PDC. These emails have been found in enterprise environments with diverse types of phishing defense, including SEGs and content filters. Due to their nature, credential phishing campaigns are often more successful at evading defense technology. Credential phishing pages are inexpensive to host, with low upkeep cost, and attackers can easily change the infrastructure that supports them. Credential phish also leave few reliable and consistent indicators of compromise (IOCs), making it easier to stay ahead in the cat- and-mouse game of detection. The average lifespan of a phishing URL is less than 24 hours, making black lists irrelevant and human detection critical.