Hunting Phish Kits

This closing question-and-answer segment follows a talk on hunting phishing kits and focuses on putting that work into practice. The main advice is to start small: first make sure user-reported phishing messages land in one central place, then build a repeatable process around them before moving on to automation.

Once reporting is centralized, the next step is automating the extraction of indicators and the inspection of email headers across the environment. The speaker notes that many organizations have no way to collect or act on reported messages at all. Gathering deeper evidence on the campaigns is the phase after that, since it helps teams prepare for future attacks and understand who is targeting them, along with their motives and tactics.

The discussion also touched on how attitudes have shifted. Years ago, getting leadership to prioritize phishing was an uphill fight. Today leadership is generally more aware and supportive. The takeaway is to automate incrementally, because phishing remains a primary infection vector and should be taken seriously.