Phishing is an attack that tries to trick people into revealing sensitive information by impersonating a trustworthy business or person, usually through fraudulent email or websites.
What it means
Per NIST, phishing uses deception — a fake but legitimate-looking message or site — to get someone to hand over data such as passwords or account numbers. It is one of the most common entry points for breaches, which is why security-awareness and incident-response roles treat it as a core topic.