What steps should Forbes security team take to defend against phishing attacks?

• A. Only rely on antivirus software
• B. User training, email filtering, multi-factor authentication, monitoring for anomalies, and incident response plan
• C. Disable all emails
• D. Postpone staff training

Answer: (B)

Defending against phishing relies on a defense-in-depth approach that combines people, processes, and technology. User training builds awareness so staff can recognize suspicious emails, links, and requests and avoid giving up credentials. Email filtering catches many phishing messages before they reach inboxes, reducing exposure. Multi-factor authentication adds a second gate, so even stolen passwords aren’t enough for attackers to gain access. Ongoing monitoring for anomalies detects unusual login patterns, unfamiliar devices, or unusual activity, enabling rapid investigation and containment. An incident response plan provides clear steps, roles, and communication to quickly contain and recover from compromises, minimizing damage. Relying only on antivirus misses many phishing attempts that exploit social engineering, while disabling email or postponing training leaves the organization dangerously exposed. Together, these elements form a practical, layered defense against phishing.