Why CISOs Should Hunt Phishing Campaigns, Not Just Emails

Jan de Vries · 2026-07-30

If you're a CISO, you know the drill. Your inbox is a war zone, and every alert feels like a fresh ambush. But here's the uncomfortable truth: most security teams are still fighting individual battles while the enemy runs a coordinated war. That's the core of IOC fatigue, and it's burning out your analysts faster than any hacker ever could. Let's talk about what's really happening. Traditional phishing detection is like trying to spot a single raindrop in a storm. You see one malicious email, you block it, you move on. But the attacker isn't sending one email. They're sending hundreds, each with slight variations, each designed to slip past your filters. By the time your team catches the fifth variant, the campaign has already evolved. ### The Problem With Indicator-Based Thinking Indicators of compromise (IOCs) are useful, but they're also limiting. When you focus on a single email's IP address, URL, or attachment hash, you're playing whack-a-mole. The attacker changes one character in the link, and suddenly your IOC is worthless. This approach creates a never-ending loop of detection and response, with no time for strategic thinking. Worse, it floods your security operations center (SOC) with false positives. Analysts spend hours chasing down emails that look suspicious but turn out to be harmless marketing blasts. That's not just inefficient; it's demoralizing. Your best people are wasting their talent on noise instead of hunting real threats. ### Thinking in Campaigns: A Shift in Perspective Campaign-based detection flips the script. Instead of asking "Is this email malicious?" you ask "Is this email part of a larger pattern?" It's the difference between looking at one chess piece and seeing the whole board. By grouping phishing attempts into campaigns based on shared infrastructure, tactics, and timing, you gain visibility that individual IOCs simply can't provide. Here's how it works in practice: - **Pattern recognition:** You identify a cluster of emails sharing a common sender domain, URL structure, or attachment family. That cluster is your campaign. - **Contextual scoring:** Each email gets a risk score based on its relationship to the campaign, not just its own attributes. A low-risk email becomes high-risk when it's part of a known campaign. - **Automated correlation:** Your tools link seemingly unrelated emails across different users and time zones, revealing the attacker's playbook. This approach doesn't just improve detection; it accelerates response. When you know you're dealing with a campaign, you can block the entire infrastructure at once, not just the latest variant. Your analysts stop chasing individual emails and start dismantling the whole operation. ### The Human Cost of IOC Fatigue Let's be honest about the human side. Analyst fatigue isn't just a buzzword; it's a real problem with real consequences. Burned-out analysts make mistakes, miss critical alerts, and eventually leave. The turnover rate in SOCs is already high, and it's not because the work is boring. It's because the work is overwhelming. Campaign-based detection gives your team something they desperately need: clarity. Instead of a chaotic stream of alerts, they see a manageable set of campaigns. Each one has a clear story, a clear threat level, and a clear response path. That reduces decision fatigue and lets your analysts focus on what they do best, which is thinking, not just clicking. ### Making the Switch Without Losing Your Mind If you're ready to move beyond IOC fatigue, start small. Don't rip out your existing tools. Instead, layer campaign intelligence on top of them. Look for solutions that automatically group related phishing emails and present them as campaigns. Train your team to think in terms of attacker behavior, not just indicators. And remember, this isn't about abandoning IOCs altogether. It's about putting them in context. An IOC is a data point; a campaign is a story. Your analysts need stories to make good decisions. > "The goal is not to catch every single phishing email. The goal is to understand the attacker's campaign so you can stop the next one before it starts." That's the mindset shift that separates reactive security teams from proactive ones. It's not a silver bullet, but it's a massive step toward reducing fatigue, improving visibility, and making your security operations more effective. The attackers are already thinking in campaigns. It's time you did too. So take a hard look at your phishing detection strategy. Are you still chasing individual emails? If so, you're not just behind the curve; you're burning out your team for nothing. Make the switch to campaign thinking, and watch your analysts breathe a little easier.