Jump to page content

Don’t Take the Bait: How to approach Phishing, Spear Phishing, and Whaling

Cyber threats are becoming more targeted, more sophisticated, and more disruptive — you must be committed to staying ahead of them.

 

As part of our ongoing investment in cyber security, we’ve recently taken part in training with the North West Cyber Resilience Centre (NWCRC) and attended the (CS)²AI Symposium™: Cyber Security for the Healthcare Sector.

These experiences help us keep abreast of the threat landscape, especially in sectors where the consequences of a breach could be life-threatening.

What Are Phishing, Spear Phishing, and Whaling?

Cyber criminals use a variety of social engineering tactics to trick people into clicking malicious links, handing over sensitive information, or unknowingly giving attackers access to critical systems.

  • Phishing is a broad-based attack, often carried out via email or text, that tries to trick many users into revealing personal or company information. Think fake emails pretending to be from banks or delivery companies.

  • Spear Phishing is more targeted. These attacks are aimed at specific individuals or roles within an organisation, and often use personal or contextual information to appear convincing.

  • Whaling is spear phishing at the executive level. These highly sophisticated attacks target senior leadership — the “big fish” — such as CEOs or CFOs, in hopes of gaining access to high-value data or decision-making authority.

Training with the NWCRC helps us to ensure that the advice we give our clients is up to date, it also reinforces our  own internal procedures for identifying, flagging, and defending against these types of attacks. 

We loved talking to Lewis a Cyber Security Analyst from NWCRC who delivered a comprehensive training session to our team.

If you're a SME in Merseyside you can get free training by signing up with the Merseyside Cyber Security Programme SMEs in Cheshire can also sign up via a separate page

 From Head of Cyber and Innovation at NWCRC, Dan Giannasi

By building resilience in your organisation, you reduce the risk that you will be a victim of an attack and help minimise the impact if you are. The journey towards cyber resilience can often seem a daunting task. Still, by working with the NWCRC, you will be supported in understanding your organisation's risks, developing effective measures to prevent attacks, and establishing plans for responding to and recovering from any incidents.

Preparing for the Worst Day

At the (CS)²AI Symposium, industry experts posed a sobering but essential question: What’s your worst day?

It’s a powerful exercise — imagining the cascading consequences of a successful cyber attack on a hospital, surgery, or connected health device. The session explored real-world disaster scenarios where both digital and physical systems are compromised — from ransomware locking access to patient records, to a vulnerability in a networked medical device affecting patient care.

The symposium shone a light on the unique risks posed by connected physical devices — from infusion pumps and imaging machines to wearable health monitors. Unlike traditional software systems, these devices may not be designed with cyber security in mind, yet they’re increasingly networked, making them a prime target.

We came away with not just insight, but a renewed focus on building resilience — planning not just to prevent attacks, but to respond and recover if they happen.

Our Commitment

By engaging with organisations like the NWCRC and attending events like the (CS)²AI Symposium, we ensure we’re always adapting, ready and keeping our advice up to date. Whether we’re protecting our own systems or supporting clients in high-stakes sectors, we take cyber security seriously — and we’re committed to doing the work to stay ahead of evolving threats.