Whale Phishing
Whale phishing, or whaling, is a targeted phishing attack aimed at senior executives, whose authority makes a single successful message unusually valuable.
What is Whale Phishing?
Definition
Whale Phishing (whaling) is a phishing attack aimed deliberately at senior executives — a chief executive, a finance director, a board member — rather than at the workforce in general. The economics explain the effort invested in it: one successful message against someone who can authorise a payment or reach strategic material is worth thousands of ordinary attempts, so the attacker researches first and writes individually. In cybersecurity terms the awkward part is that the people most targeted are frequently the ones for whom exceptions to process and policy are most readily made.
Role in cybersecurity
Whale Phishing plays an important role in building organizational resilience against cyber threats. Implementing appropriate mechanisms in this area is required by regulations such as NIS2, DORA and ISO 27001.