Anti-phishing software works in two halves: a technical half that inspects email before it reaches a person, and a human half that strengthens the person who receives it anyway. Most buying mistakes come from assuming one half does the other's job. This guide walks through what each mechanism actually does to a message, in the order it happens, and where the seams between them are.
TL;DR
- The technical half runs layered checks: sender authentication (SPF, DKIM, DMARC), reputation scoring, impersonation detection, URL rewriting and time-of-click analysis, and attachment detonation in a sandbox.
- The human half is software too: report buttons, phishing simulations, auto-remediation on failure and per-person risk scoring.
- The gap both halves share is business email compromise on legitimate infrastructure - a real domain, a real thread, nothing for the filter to flag.
- Filters stop volume; training stops intent. The ISM's personnel security guidance treats staff education on banking-detail fraud and account-modification social engineering as its own control, not an optional extra.
- The fastest way to find which half your business needs is a baseline phishing simulation.
First, what arrives at the filter
Before any anti-phishing product runs, the sending infrastructure either passes or fails three authentication standards:
- SPF checks that the sending mail server is authorised to send for the domain in the envelope.
- DKIM checks that the message was signed by a key the domain controls and was not modified in transit.
- DMARC tells the receiver what to do when SPF and DKIM fail, and gives the domain owner visibility.
These catch the cheapest attacks: spoofed senders and lookalike domains that fail authentication outright. They say nothing about content - a message can pass all three and still be a lure. That is why everything below happens on top of authentication, not instead of it.
The technical half, in the order a message is processed
- Reputation and bulk-signal scoring. The sending IP and domain are checked against reputation feeds; bulk-sending patterns, freshly registered domains and URLs shared across campaigns score the message down before content is even parsed.
- Impersonation detection. The filter compares the display name and domain against executives, vendors and frequently emailed contacts - "CEO" display names on external domains, lookalike characters, first-time senders claiming authority.
- URL rewriting and time-of-click protection. Links are rewritten to route through the security service, which checks the destination when the user clicks - because a clean URL at delivery can serve malware an hour later.
- Attachment detonation. Suspicious attachments are opened in a sandbox and observed: macros executing, embedded payloads fetching second-stage content, archives hiding executables.
- Content analysis. Natural-language models weigh urgency, payment requests, credential prompts and language patterns typical of phishing kits.
Each layer is tuned for scale. Together they stop the industrial campaigns - credential harvesting sent to millions - almost entirely. What they are weakest against is exactly where attackers invest most: low-volume, personalised lures on legitimately registered domains with no bad reputation to score.
The human half, and why it is also software
When a crafted lure passes the filter, the last control is a person - and modern platforms treat that person as a monitored control, not a vulnerability:
- Report buttons turn the inbox into a sensor. One click forwards the message to security and, in the better implementations, feeds it back to the filter so everyone else's copy is pulled.
- Phishing simulations measure the control. A simulation is a test of the whole chain: did the filter catch it, did the person recognise it, did they report it. Results are per-person, not a pass/fail for the company.
- Auto-remediation converts failure into training the same day - the person who clicks is enrolled into a short lesson on exactly the technique that caught them, which is how phishing simulations behave on Cyber Aware.
- Per-person risk scoring rolls the results up. Overdue courses, failed attempts and clicks become one number, so the follow-up goes to the people who need it - the mechanism behind human risk reporting.
The seam both halves share
Business email compromise is the attack that lives in the gap. It uses real infrastructure - a compromised vendor mailbox, a genuine executive thread, sometimes just a lookalike domain with clean authentication - so there is nothing anomalous for the technical half to flag. ASD's own guidance treats it as a people problem: the ISM's personnel security guidelines require personnel dealing with banking details and payment requests to be advised of what business email compromise is and how to manage and report it, and list the warning signs the filter cannot see - unexpected requests to change banking details, urgent payment demands, and unexpected payment requests from people in authority.
Since September 2026 the same guidelines go further: because AI can convincingly fake executive voices and video, personnel should positively identify requestors using a pre-established authentication method or an independent trusted channel before actioning account, banking or financial changes - voice or video alone is not verification (control ISM-2126). That is a trained behaviour, full stop.
This is also why "we have Microsoft 365 Defender" is not a complete answer. The baseline filtering is real, but it includes no training, no simulation and no per-person record - the human half has to come from somewhere, and awareness training is where it usually lives.
Which half does your business need?
The honest answer is both, in proportions set by your exposure:
- If you are catching bulk spam daily and staff click simulations rarely, the technical half is doing its job - invest in keeping it tuned.
- If simulations show double-digit click rates on targeted lures, or your finance team handles payment changes by email, the human half is where the next dollar goes.
- The recurring half is training: monthly scenarios, reporting drills, remediation on failure.
A structured security gap assessment makes the call with evidence rather than instinct, mapping where your controls stand before you spend.
FAQ
Does anti-phishing software read my email? The technical half inspects message metadata, links and attachments - URL rewriting and detonation touch content, which is why deployment is usually via your email platform's own security layer or a gateway. The human half collects training and simulation results, not mailbox contents.
Can anti-phishing software stop business email compromise? Not entirely. BEC frequently uses legitimate infrastructure and real threads that filters cannot safely block. Verification habits trained into finance and payment staff are the control that catches it.
What is time-of-click protection? Links are rewritten so the destination is checked at the moment of clicking, not just at delivery - catching links that were clean when the email arrived and turned malicious later.
Do phishing simulations count as anti-phishing software? Yes - they are the measurement half. A simulation tests whether the filter, the person and the reporting workflow each did their job.
How often should simulations run? Monthly or near-monthly is the working norm; the point is a measured control, not an annual surprise.
One last thing
Run one baseline simulation before buying anything. The click rate tells you which half of anti-phishing software your budget belongs in - and most teams are surprised which one it is.