Phishing

Phishing is the single most common way attackers get into a business — not by hacking a firewall, but by convincing a person to click a link, enter a password on a fake login page, or approve a payment. Modern phishing is often highly targeted and well-written, not the obviously broken emails people picture; that's why staff awareness training and MFA both matter as backstops.