Another cybersecurity incident at a bank — this time a ransomware attack by LockBit. The initial access? An employee clicked a malicious link.

Despite years of awareness training, defence investments, and improving tooling, the same pattern keeps repeating: humans remain the weakest link in the chain. Phishing and social engineering still account for a large share of initial breaches.

The honest takeaway isn’t “train people harder.” It’s “design systems assuming the click will happen.” Because eventually, it does.

Once an attacker is inside, the perimeter has already failed. What stops them now is how the internal estate is architected.

Four controls that decide what happens after the click

1. Zero Trust architecture. Treat every request as untrusted by default — no implicit trust based on network location. The user clicked the link from “inside” the corporate network? That doesn’t matter. Each access decision gets evaluated on its own merits: who, from what device, in what state, for what resource.

2. Least privilege access. The compromised user only had access to what they actually needed for their job — not the whole share drive, not every system, not standing admin rights. The blast radius of a successful phishing click is bounded by what the victim was authorised to reach.

3. Network segmentation and monitoring. Even inside the network, lateral movement isn’t free. Properly segmented environments force the attacker to break through additional boundaries, each one a chance to be detected. Monitoring catches the anomalies — unusual file access patterns, lateral connection attempts, privilege escalation.

4. Multi-factor authentication. Stolen credentials alone shouldn’t be enough to access anything sensitive. MFA — ideally phishing-resistant MFA like passkeys or hardware keys — raises the bar so that knowing a password gets you nowhere on its own.

The shift worth making

The traditional model — strong perimeter, soft interior — has been broken for a long time. What’s harder to internalise is that the goal of security architecture isn’t to prevent the initial breach. It’s to make sure that when (not if) the breach happens, the attacker hits walls instead of running through hallways.

The click was always going to happen. The question is whether your architecture treated that as a one-line incident or a six-month recovery.

Incident details: LockBit bank ransomware report