Spear phishing is a phishing message written for one person, using true details about them. The useful question is where the attacker got the details.
Short answer: Spear phishing is a phishing message aimed at one named person and built from true details about them: their role, their colleagues, the client they are working on, the software they use. Ordinary phishing is a net. Spear phishing is written for you, which is exactly why the usual advice about spotting bad spelling stops helping.
Key takeaways
Phishing is volume. The same message goes to thousands of addresses, hoping a small fraction respond. It is cheap, generic and usually easy to recognise, because it cannot afford to know anything about you.
Spear phishing is aimed. One recipient, one context, details that are correct. It might name your practice management software, reference a matter you are genuinely working on, or arrive from a supplier you genuinely use, on the day an invoice was genuinely due.
Whaling is spear phishing aimed at a senior person, usually to authorise a payment or release information.
The distinction people miss is that the escalation is not technical. A spear phishing email uses no more sophisticated machinery than a bulk one. What it has is homework.
This is the part that connects to everything else on this blog. The material is almost never stolen in a dramatic way. It accumulates.
Public sources. Your website's team page, LinkedIn, a job advertisement naming your systems, an out of office reply naming who to contact instead, an industry directory, a conference programme, a council tender notice listing your firm as a supplier.
Previous breaches elsewhere. An unrelated service your staff member signed up to years ago is breached, and the address, password and often the employer are now in circulation.
Your own outbound information. Email signatures, invoice templates, quotation formats and document footers all teach an attacker what your correspondence looks like.
Material your team sends to third party services. This is the newest source and the least considered. A tender document uploaded to a chat tool contains your pricing, your client, your project names and the way your people write. A pasted bank statement contains a client's account details and transaction pattern. None of that is exposed in a normal week. It becomes exposed when a service retains it and a service is later breached, or when the account holding it is compromised.
The general rule is simple and unglamorous: the quality of a spear phishing message is a function of how much true information the attacker has, and true information leaks slowly, from many small places.
The standard advice lists poor spelling, generic greetings, mismatched sender addresses and unusual urgency. Every item on that list is a symptom of a message written cheaply and at scale.
A message written for one recipient has none of them. It uses your name and your client's name, it refers to a real piece of work, its tone matches the person it claims to be from, and its request is one you were expecting. There is nothing to spot, because there is no mistake.
Generative writing tools have removed the last reliable tell, which was awkward English. That is a real change and worth saying plainly, without exaggerating it: the con is the same, the fluency is better. A grammatical error was never a security control, it was a lucky accident that we came to rely on.
Replace detection with verification. The point of a verification habit is that it works even when the message is perfect, because it does not depend on the message at all.
Verify out of band. Any request to change bank details, send identity documents or make an urgent payment gets confirmed on a channel the message did not arrive on, using a contact you already had. Never a phone number contained in the message.
Make the rule apply to the owner. Attackers impersonate authority because authority is not questioned. If your rule has an exception for the director, that exception is the attack.
Slow the specific moments down. You do not need to be suspicious of everything. Two categories deserve a pause: money moving, and identity documents leaving.
Reduce what is available to research you with. Fewer public details about who approves payments. Retire mailboxes and accounts you no longer use. Do not put client material into services that keep it when you do not need to.
That last point is where Prinn works. It runs on each person's computer and checks a prompt before it is sent, so client identifiers, financial details and credentials do not quietly accumulate inside a third party service. If it finds something sensitive it shows what it found and offers three choices: redact it, stop, or send it as is. The person decides, and it never blocks anyone. Prompt content never leaves the machine, including to us.
Prinn does not filter your email and does not detect phishing. It reduces one of the supply lines that makes a spear phishing message convincing.
Spear phishing is not a more advanced attack. It is the same attack with better preparation, and the preparation is assembled from things your business gives away without noticing. You cannot make yourself invisible, and you should not try.
What you can do is make the two decisions that actually cost money, paying and disclosing, depend on verification rather than on judgement about a message. Then it does not matter how good the message is.