Automatic phishing detection methods in corporate email systems: a systematic review

Abstract

Phishing through email is a growing threat to corporate cybersecurity, where traditional detection methods frequently fail against sophisticated attacks. This review aims to identify and evaluate automatic phishing detection methods (based on Deep Learning and Machine Learning) in contrast with traditional systems, focusing on email analysis and their application in corporate and organizational environments. Method: The review was structured using the PICOC methodology to formulate the research question. A systematic process based on PRISMA was applied, conducting searches in key databases such as Scopus and Web of Science. Articles published between 2021 and 2025 were selected, and after applying inclusion/exclusion criteria, 21 studies were thoroughly reviewed. Results: The findings demonstrate the algorithmic superiority of advanced methods, such as Deep Learning (DL) models and Transformer-based approaches (LLMs), which outperform traditional and shallow ML techniques. These models consistently achieved accuracies above 99% in classification tasks. Conclusions: The study identifies a critical operational gap: this high accuracy is limited to simulated environments and lacks evidence of validation in real corporate settings, such as Office 365. It is concluded that the practical applicability of the most accurate methods remains uncertain, requiring future research to focus on validation in production environments and on mitigating the risk of secondary threats such as ransomware.