What can protect users from a phishing attack that is sent via email?

End-user training and vigilance is the best way to protect users from phishing attacks. A phishing attack is an email or site that looks legitimate and baits the user to enter their credentials. If a user can identify a phishing attempt that looks like a legitimate request, they can protect themselves by ignoring the phishing attempt or deleting it. Antimalware and antivirus software will not protect you from phishing attacks since they are engineered to protect you from malware or viruses. Certificates can be used internally to sign emails, but external vendors do not normally use certificates to sign emails.