thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Phishing vs Spear Phishing vs Whaling: What's the Difference?

Phishing is a broad, untargeted fraudulent message sent to many people. Spear phishing targets a specific person or group with tailored content, and whaling is spear phishing aimed at senior executives or other high-value individuals.

vs

Spear Phishing

Full definition
vs
PhishingSpear PhishingWhaling
TargetMass audienceSpecific individuals or groupsExecutives (CEO, CFO, board)
PersonalizationLow, generic luresHigh, uses researched detailsVery high, business-context lures
VolumeThousands to millionsFewVery few
Typical lureFake package delivery, password resetMessage referencing a real project or colleagueLegal subpoena, board matter, wire approval
Primary defenseEmail filtering, awareness trainingTraining, DMARC, reporting cultureExecutive training, out-of-band verification of payments
Remember it

Phishing casts a net, spear phishing throws a spear, whaling hunts the biggest fish.

Exam tip

Any mention of a CEO or CFO being targeted means whaling. If a message impersonates an executive to request a wire transfer, think business email compromise (BEC).

Tested on

More Security Fundamentals & Crypto look-alikes