Why CISOs Should Stop Chasing IOCs and Start Tracking Campaigns

Jan de Vries · 2026-07-30

If you're a CISO, you know the drill. Your inbox floods with alerts. Each one screams that a suspicious file hash, a shady IP address, or a weird domain just popped up. You chase each one. You block it. You move on. Then an hour later, another alert arrives. Same pattern. Different variant. It feels like playing whack-a-mole, and honestly, it's exhausting. That fatigue has a name: IOC fatigue. IOCs, or indicators of compromise, are the bread and butter of traditional phishing detection. But here's the thing—they're not enough anymore. Cofense, a leader in phishing defense, argues that CISOs need to shift their mindset from individual emails to entire campaigns. It's a subtle shift, but it changes everything. ### The Problem with Fixating on IOCs Let's break down why IOCs are failing you. An IOC is a single data point. It could be a malicious attachment's hash, a sender's email address, or a URL. When you detect one, you're treating the symptom, not the disease. Phishers know this. They rotate their infrastructure constantly. They tweak a few characters in a domain, spin up a new server, or swap a payload. Suddenly, your blocklist is useless. Think of it like this: chasing IOCs is like trying to stop a flood by plugging one hole at a time with your finger. You might slow the water for a second, but the pressure builds elsewhere. Before long, water bursts through a new crack. You're always behind, always reacting, and your analysts are burning out. ### Campaign-Based Thinking: The Big Picture Campaign-based detection flips the script. Instead of asking "Is this email malicious?" you ask "What is this attacker trying to accomplish?" A campaign is a coordinated set of actions with a single goal. Maybe it's credential theft for a specific bank. Maybe it's deploying ransomware across a sector. When you identify a campaign, you see the whole chessboard, not just one pawn. Cofense highlights that this approach gives you three massive wins. First, visibility. You understand the attacker's playbook. You see their infrastructure, their lure themes, and their timing. Second, speed. You can predict where the next attack will hit before it does. That's proactive, not reactive. Third, efficiency. Your analysts stop chasing ghosts. They focus on high-value threats that actually matter. ### How to Make the Shift in Your SOC Changing your team's mindset isn't a flip of a switch. It takes deliberate effort. Here's a practical starting point: - **Correlate everything**: Don't look at alerts in isolation. Group them by sender patterns, subject lines, or attachment types. Look for clusters. - **Prioritize by campaign intent**: A phishing email targeting your finance team with fake invoices is more dangerous than a generic password reset scam. Rank campaigns by potential impact. - **Invest in threat intelligence**: Your SIEM is only as good as the data you feed it. Use intel feeds that track campaign infrastructure, not just discrete IOCs. - **Automate the mundane**: Let machines handle the repetitive blocking. Free your humans to investigate the complex, multi-stage campaigns. One CISO I spoke with put it this way: "We stopped asking 'Is this bad?' and started asking 'How does this fit into what we know?' That single question cut our false positives by half." That's the power of context. ### The Payoff: Less Noise, More Signal Ultimately, this isn't just about better security. It's about your team's sanity. Analyst fatigue leads to burnout, turnover, and missed alerts. When you shift to campaign thinking, you reduce the noise. Your analysts see fewer, but more meaningful, alerts. They can actually investigate, respond, and close out threats. That's a morale booster. Plus, you gain a strategic advantage. You can brief your board on the threat landscape with confidence. You can say, "We're seeing a rise in supply chain phishing targeting our vendors, and here's our mitigation plan." That's a far cry from "We blocked 50 malicious emails today." The bottom line is simple: IOCs are useful, but they're just fragments. Campaigns are the full story. If you want to get ahead of attackers, you need to read the book, not just a single page. Start thinking in campaigns, and you'll see the difference in your visibility, your response times, and your team's energy levels. It's time to put the fire hose down and pick up a map instead.