Common Threats: Malware, Phishing & Social Engineering

Malware is software designed to harm or exploit a system — viruses, ransomware, spyware.

Example: how a typical attack actually starts

An employee receives an email that looks exactly like it's from IT, asking them to "verify their password" through a link. The link leads to a fake login page that looks identical to the real one. The employee types their real password in — and now the attacker has it, with zero malware, zero exploited software vulnerability, and zero technical sophistication involved at all.

That's phishing: tricking someone into handing over credentials or clicking a malicious link, disguised as something legitimate. Social engineering is the broader category both belong to — manipulating people, not just software, into doing something insecure. Most real breaches start with a person, not a purely technical flaw, which is exactly why security awareness training matters as much as any firewall or antivirus tool.