Phishing Defense Guide 2026: Email, SMS, Voice & QR Tactics

The 2026 Phishing Landscape: Scale, Speed, and AI Transformation

Phishing has moved beyond email. In 2026, the threat landscape has fundamentally shifted toward coordinated, multi-channel attacks powered by artificial intelligence and operationalized by well-resourced threat actors. Over 90% of cyberattacks begin with phishing, and the economics heavily favor attackers: threat actors can now deploy a convincing campaign in minutes rather than hours, using generative AI tools that cost as little as $75 and require no special skills.

The scale is alarming. 3.4 billion phishing emails are sent daily, with 82.6% now using AI-generated content. Yet despite this volume, the sophistication gap between attackers and defenses is narrowing. In early 2026, Microsoft detected 8.3 billion email-based phishing threats in Q1 alone, with QR code phishing doubling from January to March. Simultaneously, threat actors have industrialized social engineering: vishing (voice phishing) surged 442% between mid-2024 and late 2024, and 19% of all breaches now originate from smishing or vishing combined.

What makes 2026 different is not just volume or speed. It is the systematic collapse of the barriers that once separated sophisticated attacks from commodity phishing. Phishing-as-a-Service platforms like Tycoon 2FA (which controls 89% of the adversary-in-the-middle PhaaS segment) have democratized attacks that once required elite capability. Voice cloning has become commodity-grade. QR codes now bypass email security entirely. And organizational defenses, despite massive investment, remain vulnerable to human psychology—a 21-second median time to click means employees are compromised before they finish reading the message.

Email Phishing 2026: The Dominant Channel Evolves

Traditional Email Phishing vs. AI-Enhanced Variants

Email remains the dominant phishing vector, accounting for roughly 70% of initial access attempts. But the nature of email phishing has transformed. Traditional phishing emails were generic, poorly written, and easy to spot—subject lines full of grammatical errors, vague sender addresses, and obvious urgency tactics. Those red flags are gone.

AI-generated phishing emails are contextually accurate, grammatically flawless, and often reference real names, relationships, and organizational details scraped from LinkedIn, company websites, and social media. The click rate has more than quadrupled: while traditional phishing achieves roughly 12% click-through rates, AI-generated variants achieve 54% or higher—matching the effectiveness of human expert attackers at 95% lower cost.

Real-World Example: The Microsoft 365 Impersonation Campaign

The most consistent email lure remains the fake Microsoft 365 password expiration notice. This attack pattern has remained stable throughout 2025 and into 2026, not because it is subtle, but because it exploits reflexive behavior. An employee sees an email claiming their password will expire, clicks a link to re-authenticate, and enters credentials into a convincing fake portal. The entire compromise takes under 60 seconds. Attackers repeat this because it works: the generic version catches 12% of recipients; the AI-personalized version catches 54%.

Other volume leaders include fake DocuSign notifications, fake invoices (often with QR codes embedded), fake delivery notifications, and IT helpdesk impersonations. None of these is new in 2026. What is new is the speed of adaptation. Attackers using AI can generate variations of each template—each subtly different from the last—at scale and with zero human effort.

Clone Phishing and Mailbox Rule Attacks

Clone phishing—where an attacker copies a legitimate email you received and swaps the links for malicious versions—remains effective because it bypasses all the trust signals in legitimate communication. The attacker intercepts a real invoice from a supplier, resends it with a malicious payment link, and the recipient often doesn't notice the sender address changed.

A related and increasingly common attack exploits compromised email accounts to create inbox rules that automatically forward sensitive emails (like password resets or MFA challenges) to attacker-controlled accounts. These mailbox rule modifications are hard to detect without explicit monitoring, and they persist even after credential reset if MFA enrollment endpoints are compromised first.

Smishing (SMS Phishing): The Mobile-First Threat

Why SMS Phishing Works at Scale

SMS phishing, or smishing, has exploded because mobile devices lack the equivalent of enterprise email security gateways. SMS-based phishing accounts for 35% of all phishing attacks and surged 40% year-over-year. The attack works because text messages feel immediate and personal—a text from your bank feels more trustworthy than an email, especially if the sender spoofs a real bank number using caller ID spoofing or short codes that mimic legitimate services.

Mobile browsers also hide the full URL in the address bar, making it impossible to verify where a link actually leads before tapping. Combined with the fact that personal mobile devices typically have weaker security controls than corporate endpoints, smishing targets a structural vulnerability in how we secure phones.

Common Smishing Attack Patterns

Package Delivery Fraud: "Your package could not be delivered. Click here to reschedule." The link leads to a fake courier website designed to harvest login credentials. This attack exploits the routine nature of online shopping and the expectation that courier notifications arrive as texts.

Bank Account Compromises: "Suspicious activity detected on your account. Verify your identity here." The attacker's domain looks like the bank's legitimate one, often using homograph attacks (domains that visually mimic real bank domains using similar-looking characters) or slight misspellings (e.g., "amaz0n.com" instead of "amazon.com").

One-Time Password (OTP) Theft: Smishing combined with a phishing email or vishing call that asks the victim to read their SMS-delivered OTP aloud. The attacker captures the OTP, uses it to authenticate as the victim, and potentially enrolls a new phone or approves a malicious MFA method.

Defensive Measures for Smishing

• Do not tap links in unexpected texts, regardless of how official they look. Instead, call the official number on your card or navigate directly to the website in your browser.
• Forward suspicious texts to 7726 (SPAM), a carrier-shared reporting number that feeds into law enforcement and carrier fraud teams.
• Enable call screening and spam filtering features on your phone (iOS and Android both offer native options).
• Set a port-out PIN or additional verification with your mobile carrier to prevent SIM-swap attacks that intercept SMS-based MFA codes.
• Use email aliases for different accounts so that a breach at one service does not expose your real phone number to phishers.
• Monitor for unsolicited reset or enrollment notifications via text. If you receive an SMS saying a new device was registered, disconnect and contact the organization directly using an official number.

Vishing (Voice Phishing): AI Voice Cloning and MFA Fatigue

The Rise of Voice Phishing in 2026

Voice phishing, or vishing, has become a primary attack vector in 2026. Mandiant documented that highly interactive voice phishing accounted for 11% of observed initial infection vectors in 2025, making it the second most common vector in their dataset. This represents a dramatic shift from five years ago, when vishing was a niche tactic. CrowdStrike's 2025 Global Threat Report logged a 442% surge in vishing activity between H1 and H2 2024, and the follow-up threat hunting report showed H1 2025 vishing volume already exceeding full-year 2024 totals.

What has changed is both the attacker tooling and the attack surface. Voice cloning—AI tools that can replicate a specific person's voice from a short audio sample—has advanced to the point where deepfake calls are now indistinguishable from legitimate calls. Pindrop's contact center telemetry shows a +1,300% increase in deepfake fraud attempts in 2024, occurring alongside underlying live-human vishing volume.

Real-World Vishing Incidents: Named Threat Actor Examples

Scattered Spider (aka UNC3944, Octo Tempest, Storm-0875, Muddled Libra) is one of the most prolific vishing threat actors currently active. The group uses voice phishing calls to help desk employees to manipulate password resets, MFA enrollments, and access grants. Named incidents include:

• MGM (2023): Scattered Spider used vishing to gain initial access, eventually leading to operational disruption costing an estimated $100 million.
• Caesars Entertainment (2023): Vishing calls to support staff led to a $15 million ransomware incident.
• Snowflake (2024): The group compromised approximately 165 Snowflake customers through stolen credentials obtained via help desk vishing.

In April 2026, Tyler Buchanan ("Tylerb"), a member of Scattered Spider, pleaded guilty to wire fraud conspiracy and aggravated identity theft, admitting to at least $8 million in stolen virtual currency. His sentencing is scheduled for August 2026.

Attack Mechanics: Help Desk Manipulation and MFA Bypass

The most damaging vishing attacks in 2026 do not ask for passwords. Instead, they exploit help desk workflows directly. The attacker calls the help desk and claims to be an employee locked out of their account. The attacker asks the help desk representative to enroll a new phone for MFA, approve a connected application, or reset credentials. From the help desk's perspective, the request appears legitimate—it is processed through legitimate help desk procedures, and the resulting login is technically valid.

Once the attacker has enrolled their own device or application, they can authenticate without the original password or MFA challenge, because the system now trusts their device. This bypass does not require stealing credentials; it exploits the recovery workflows that help desks use to legitimately reset accounts for locked-out users.

The defensive implication is structural: identity verification must move out of the voice channel entirely. Organizations should use out-of-band verification (e.g., confirmation through a corporate identity provider, SMS to a registered phone, or biometric confirmation) rather than voice-based confirmation. Every named enterprise vishing breach in 2023–2025 (MGM, Caesars, Snowflake, M&S, Co-op) begins with a vishing call to help desk, followed by a password reset or MFA bypass.

How to Recognize and Defend Against Vishing

• Slow down on calls from vendors, IT support, or executives. If someone claims to need urgent action, hang up and call back using the official number on your company's website or card.
• Implement callback verification protocols. When an employee calls the help desk, confirm their identity through an out-of-band channel (a separate email, SMS from a registered device, or identity provider confirmation) before resetting credentials.
• Use code words for inbound IT calls. Establish a shared code word that legitimate IT staff will know; if an incoming caller cannot provide it, do not comply with requests.
• Enable voice biometrics or speaker recognition in contact centers to detect deepfake voice calls. Pindrop and similar tools can identify deepfake calls with high accuracy.
• Monitor for unauthorized MFA enrollments or device registrations. If you receive notifications about new devices or applications being connected to your accounts, investigate immediately.
• Advocate for identity provider-mediated verification for all password resets and MFA enrollments. Microsoft, CISA, and Mandiant all explicitly recommend this control.
• Implement rate limiting on password reset and MFA enrollment requests to prevent rapid automation of these processes after a single successful vishing call.

Quishing (QR Code Phishing): The Bypass Channel

Why QR Codes Bypass Traditional Email Defenses

QR code phishing, or quishing, has become the fastest-growing phishing vector because it exploits a fundamental gap in how email security tools work. Most email security gateways scan email text and links for malicious content, but QR codes are images. The encoded URL inside a QR code is invisible to text-based scanning engines until a user scans it, at which point the redirect is already in progress.

QR code attacks increased 400% between 2023 and 2025. In Q1 2026, the trend accelerated dramatically: Microsoft detected QR code phishing attacks increasing from 7.6 million in January to 18.7 million in March, a 147% increase in a single quarter. The most affected sectors are energy, healthcare, and manufacturing—industries with mixed IT security postures and large distributed workforces.

Common Quishing Attack Patterns

Fake Invoice Attacks: Attackers send an email with a PDF invoice attachment containing an embedded QR code. The email claims the invoice is ready for review. The victim scans the QR code (often using their personal phone, which has weaker security controls), and the code redirects to a fake payment portal designed to harvest credentials or payment details.

IT Verification Scams: An email claims to be from the IT department asking the recipient to verify their identity by scanning a QR code. The code redirects to a fake login page that mirrors the company's legitimate authentication portal, complete with MFA step simulation. The attacker captures both the username and password, and in some cases, the MFA response itself.

Physical Quishing (Parking Meter & Flyer Attacks): Attackers print QR code stickers and place them over legitimate parking meter QR codes or affix them to public flyers. When scanned, the code redirects to malicious sites designed to steal payment information or infect devices. Between April 2024 and April 2025, UK Action Fraud logged 784 quishing reports with losses near £3.5 million.

Adversary-in-the-Middle (AITM) Quishing: In the most sophisticated variant, the QR code redirects to a reverse-proxy phishing site that relays authentication attempts to the legitimate service in real-time. The victim enters their credentials, completes their MFA challenge, and the attacker's reverse proxy captures both the credentials and the MFA response. The attacker can then use that response to impersonate the victim without needing to bypass MFA directly. Google's June 2026 advisory specifically flagged AITM-enabled quishing attacks that mirror legitimate login flows—including the MFA challenge—to capture both the user's password and the active session cookie simultaneously.

Defensive Measures for Quishing

• Do not scan QR codes from unexpected emails or public spaces without verifying the domain first. If the email claims to be from your bank, navigate to the bank's official website directly instead of scanning a code.
• Use a QR code scanner that previews the destination URL before redirecting. Some mobile apps allow you to see where a code leads before opening it.
• Check the URL after scanning. Even if a QR code redirects successfully, look at the address bar to confirm you are on the legitimate domain, not a homograph attack or look-alike domain.
• Enable phishing-resistant MFA (FIDO2 or passkeys) rather than TOTP or SMS-based MFA. Phishing-resistant MFA cannot be intercepted or replayed by reverse-proxy attacks, because cryptographic verification of the legitimate domain is built into the protocol.
• Use an email security platform that scans QR codes. Advanced platforms extract and analyze embedded URLs from QR codes in attachments and inline images.
• Deploy a web content isolation architecture that runs untrusted content in a sandboxed container, isolating it from your device and network.
• Train staff to verify sender context. QR codes embedded in PDF invoices should trigger a direct verification step: contact the vendor using an official phone number to confirm the invoice before payment.

Threat Actors Driving Phishing at Scale in 2026

Phishing-as-a-Service Platforms and Named Actors

Phishing is no longer a niche attack. It is operationalized, commercialized, and distributed through specialized criminal ecosystems. Tycoon 2FA controls 89% market share of the adversary-in-the-middle PhaaS segment, providing infrastructure, templates, and harvesting capabilities to thousands of attackers. The group emerged in August 2023 and has become one of the most widespread PhaaS platforms by leveraging adversary-in-the-middle techniques to defeat non-phishing-resistant MFA.

In Q1 2026, Microsoft Threat Intelligence observed Tycoon2FA operating from a variety of infrastructure providers, with the group actively shifting hosting from Cloudflare to alternative platforms in response to disruption efforts. The platform's availability and ease of use mean that attackers with minimal skill can launch sophisticated phishing campaigns at scale.

Scattered Spider (UNC3944, Octo Tempest, Storm-0875, Muddled Libra) is another dominant actor, notable for its combination of vishing, social engineering, and supply chain targeting. The group has compromised over 130 organizations in a single operation within the tech sector, using a small number of entry points to cascade across entire industries. The group prioritizes help desk compromise and MFA bypass, using techniques that require no technical exploitation—pure social engineering executed at scale.

Nation-State Actors and AI-Enhanced Phishing

State-sponsored actors have operationalized AI for phishing at scale. APT34 (OilRig), an Iran-linked group, has integrated AI-generated spear phishing content into campaigns targeting UAE organizations, incorporating accurate details about target individuals' professional histories, publications, and organizational relationships—details that would require hours of human reconnaissance but can now be generated automatically by AI analyzing public data.

Lazarus Group, the North Korean state-linked actor, remains the most financially destructive threat actor documented, responsible for over $6.5 billion in cryptocurrency theft within its operational lifespan and over $2.02 billion in 2025 alone. The group uses phishing as one component of a broader financial crime and espionage toolkit that includes supply chain compromise and malware deployment.

MuddyWater, a state-aligned cyber espionage group targeting government, financial services, and logistics sectors across 113 countries, has demonstrated unprecedented operational tempo: between October 2025 and March 2026, the group deployed three new malware variants, illustrating the velocity of adversary development cycles that defenders must now anticipate.

AI as a Multiplier for Attacks

The integration of generative AI across phishing operations is not experimental—it is mainstream. Between September 2024 and February 2025, 82.6% of detected phishing emails utilized AI. The month of December 2025 marked an inflection point: AI-assisted attacks surged from 4% of all reported phishing in November to 56% in December, a 14-fold jump driven by criminal actors mass-producing convincing lures at zero skill cost. By early 2026, that share had stabilized at around 40%, meaning four in ten phishing attempts a reader encounters today are AI-generated.

ENISA data for 2025 indicates 80% of all phishing campaigns now contain AI-generated content. APT36 has used AI as a polymorphic malware assembly line, producing variants faster than signature-based detection can respond. MuddyWater's Dindoor backdoor—written in Deno's JavaScript runtime—shows construction patterns consistent with GenAI-assisted development. This is not about individual groups experimenting; all four major nation-state blocs (Russia, China, Iran, North Korea) operationalized large language models during 2025.

Multi-Layer Defense Strategy: What Actually Works in 2026

The Layered Defense Model

No single control stops all phishing. Organizations and individuals must adopt a layered approach. The data is clear on what works and what does not:

• MFA (multifactor authentication) blocks credential reuse but does not stop MFA fatigue attacks (where users are repeatedly prompted for MFA until they approve a malicious request) or adversary-in-the-middle phishing.
• Security awareness training reduces click rates (from 33% untrained to 4% after 12 months of behavior-based training) but cannot reach zero.
• Email security gateways catch most attacks but not all—especially QR code phishing, which bypasses text-based URL scanning.
• Together, they create defense in depth. The combination of phishing-resistant MFA + behavior-based training + advanced email security is what actually works.

Step-by-Step: Implementing Phishing-Resistant Security in 2026

1. Deploy phishing-resistant MFA (FIDO2 or passkeys). These authentication methods cryptographically verify the legitimate domain, making them immune to reverse-proxy phishing attacks. Prioritize phishing-resistant MFA for high-value accounts (executives, finance, IT staff).
2. Implement out-of-band identity verification for help desk access. When an employee calls the help desk requesting a password reset or MFA re-enrollment, verify their identity through an independent channel (corporate identity provider, SMS to registered device, or biometric confirmation) before processing the request.
3. Deploy behavioral anomaly detection in email systems. Tools like Sublime Security or Abnormal Security learn an organization's normal communication patterns and flag messages that deviate subtly in tone, metadata, or behavior—even if they come from legitimate-looking addresses.
4. Run quarterly multi-channel phishing simulations. Rather than email-only simulations, include smishing and vishing lures that mirror real attack patterns. Track results by user, role, and department.
5. Configure DMARC, SPF, and DKIM correctly. These email authentication protocols prevent attackers from spoofing your organization's domain. Set DMARC policy to "reject" (not "quarantine") to prevent spoofed messages from reaching inboxes.
6. Monitor for unauthorized mailbox rules and device enrollments. Set up alerts for mailbox rules that forward emails to external accounts, and audit MFA device registrations regularly.
7. Use a password manager like Bitwarden or NordPass to generate and store unique passwords for each account. This prevents credential reuse even if a phishing site harvests your password for one service. Bitwarden is open-source and can be self-hosted, while NordPass integrates with enterprise identity systems.
8. Enable DNS filtering and web content isolation for risky users. For executives and finance staff, block access to newly registered domains and run untrusted web content in a sandboxed container.
9. Train help desk staff on vishing tactics and implement runbooks. Help desk representatives should know common vishing pretexts and have clear procedures for verifying caller identity before processing sensitive requests.
10. Invest in voice biometrics or speaker recognition for contact centers. These tools can detect deepfake voice calls with high accuracy.
11. Use NordVPN or a corporate VPN to encrypt traffic and prevent attackers on shared networks from harvesting credentials over unencrypted protocols. This is especially important for remote workers accessing corporate systems from home networks or public Wi-Fi.
12. Set up a security feedback loop. Create a simple way for employees to report phishing (a "Report Phishing" button in email, a reporting email address, or an internal reporting portal), and respond quickly to reported incidents.

Incident Response for Phishing Compromise

If you suspect you have clicked a phishing link or entered credentials into a malicious site, act immediately:

1. Isolate the affected device. Disconnect from the network and power down if malware may have downloaded.
2. Reset your password from a different, trusted device, using a strong, unique password.
3. Change passwords for all related accounts that share the same or similar credentials.
4. Enable MFA on all accounts if not already enabled.
5. Monitor account activity for unauthorized logins or changes. Check email forwarding rules, connected applications, and device enrollments.
6. If work-related, notify your IT department immediately. They can reset your credentials on corporate systems and check for lateral movement.
7. Document the incident: Take a screenshot of the email or message, note the timestamp, and record any actions you took. This helps security teams identify attack patterns.

Key Takeaways: Phishing Defense 2026

• Phishing is the #1 attack vector: Over 90% of cyberattacks begin with phishing, and the average phishing-caused breach costs $4.88 million.
• AI has transformed phishing from crude spam to hyper-personalized attacks: 82.6% of phishing emails now use AI, achieving click rates of 54% or higher—matching human expert attackers at 95% lower cost.
• Multi-channel attacks are now the norm: Email phishing is dominant, but smishing (35% of attacks), vishing (442% surge in 2024), and quishing (400% increase since 2023) are growing rapidly.
• No single control works: MFA alone does not stop MFA fatigue or AITM attacks. Training alone cannot reach zero click rates. The only approach that works is layered defense combining phishing-resistant MFA, behavior-based training, and advanced email security.
• Help desk is the attack surface: Named 2023–2025 vishing breaches (MGM, Caesars, Snowflake) all exploited help desk workflows. Move identity verification out of the voice channel.
• Threat actors are industrialized: PhaaS platforms like Tycoon 2FA, criminal actors like Scattered Spider, and nation-state groups all operationalize phishing at scale.
• 21 seconds is the median time to click: Employees are compromised faster than they can read the email. Reflexive behavior, not careful analysis, drives most phishing success.

FAQ: Phishing Defense in 2026

Q: What is the difference between phishing-resistant MFA and regular MFA?

A: Regular MFA (TOTP, SMS, email codes) provides a second factor of authentication but can be intercepted or replayed. Phishing-resistant MFA (FIDO2 hardware keys, passkeys, WebAuthn) cryptographically verifies that you are authenticating to the legitimate service, not a fake one. When you use phishing-resistant MFA, even if you enter your credentials on a reverse-proxy phishing site, the MFA prompt will fail because the attacker's proxy cannot prove to your authenticator that it represents the legitimate domain. This makes phishing-resistant MFA immune to AITM attacks.

Q: If I clicked a phishing link but did not enter credentials, am I safe?

A: Not necessarily. Clicking a phishing link can download malware, exploit browser vulnerabilities, or trigger account-tracking attacks (where the phisher now knows your link was valid and may target you more aggressively in future campaigns). Even if no malware downloaded, your click confirms to the attacker that your email address is active and monitored, making you a higher-priority target. Assume your click was logged, and monitor your accounts for unauthorized access or unexpected emails.

Q: How can I tell if a QR code is malicious before scanning?

A: You cannot. A QR code shows nothing until you scan it. This is the fundamental design flaw that makes quishing so effective. Your only defenses are: (1) do not scan QR codes from unexpected emails or public spaces, (2) if you must scan a code, use a scanner app that previews the destination URL before redirecting, and (3) after scanning, check the address bar to confirm you are on the legitimate domain, not a lookalike.

Q: Should I use a password manager, and which one is secure?

A: Yes. A password manager like Bitwarden (open-source, self-hostable) or NordPass (integrated with enterprise systems) allows you to generate and store unique, strong passwords for each account. This prevents credential reuse even if one phishing attack harvests your password for a single service. Bitwarden is more transparent (open-source code) and gives you control over data storage (self-hosted); NordPass is more convenient for enterprise environments. Both are better than password reuse, which is the single biggest factor in successful account takeovers.

Q: What should I do if my organization does not have phishing-resistant MFA yet?

A: Advocate for it at your organization. In the meantime, use TOTP-based MFA (like Google Authenticator or Authy) rather than SMS-based MFA, because SMS is vulnerable to SIM-swap attacks and phishing redirection. Enable MFA everywhere possible, even if it is not phishing-resistant. Monitor your accounts closely for unauthorized access. Use a password manager to prevent credential reuse. And be extra cautious with voice calls claiming to be from IT or executives asking for passwords or MFA codes—this is almost certainly vishing.

Conclusion: The 2026 Phishing Imperative

Phishing in 2026 is a convergence of scale, speed, sophistication, and industrialization. The volume is staggering—3.4 billion emails daily, with 82.6% using AI. The evolution is relentless—QR code phishing doubled in a quarter, vishing surged 442% in a year, and deepfake voice calls now fool contact center operators routinely. The threat actors are sophisticated and well-resourced: nation-state groups like Lazarus and MuddyWater operationalize AI for espionage and financial crime; financially motivated actors like Scattered Spider and Tycoon 2FA target supply chains and help desks at scale.

Yet the defense landscape remains humanistic. The median time to click is 21 seconds—faster than reading. The most damaging vishing breaches do not require stealing passwords; they exploit trust in legitimate help desk workflows. The most successful emails do not trigger skepticism; they exploit urgency, authority, and familiarity. AI has made phishing more efficient, but human psychology remains the true vulnerability.

The organizations and individuals who will survive the 2026 phishing landscape are those who accept three hard truths: (1) no single control works—defense must be layered across MFA, training, email security, and behavioral analysis; (2) help desk and identity verification processes are as critical as email gateways, because vishing attacks that exploit these workflows are now among the most damaging; and (3) security is not a one-time purchase of tools, but an ongoing process of monitoring, training, simulation, and adaptation.

For those willing to invest in layered defense, the data is reassuring: organizations that combine phishing-resistant MFA with behavior-based security training and advanced email security reduce their phishing risk to near-zero. The defenses exist. The question is not whether they work, but whether organizations and individuals are willing to implement them at scale.