Spear Phishing: Everything You Wanted to Know

**Executive Summary:** This article defines spear phishing and whaling as targeted, socially engineered forms of phishing that rely on researched impersonation, specific targeting, and urgent calls to action to deceive high-value recipients, contrasts them with mass phishing, and recommends defenses including phishing simulations and training, external-email banners, clear change-management communications, person-to-person confirmations for sensitive transactions, limiting public exposure of organizational details, and monitoring for account takeovers.