Phishing Attack Detection Using Machine Learning in Corporate Email

Machine learning offers useful methods for identifying phishing messages, but strong benchmark performance does not automatically establish dependable protection in corporate email systems. This article examines the relationship between published detection results and the evidence required for organisational deployment. A focused critical literature review integrates peerreviewed phishing studies and reviews with methodological research, dataset documentation and authoritative technical guidance. Sources were verified through targeted publisher, institutional and standards searches completed on 29 October 2026. The synthesis distinguishes conventional classifiers, neural architectures and contextual enterprise detectors, while separating email-level evidence from phishing-URL classification. Published enterprise studies demonstrate that communication history and message context can support highly selective detection of particular impersonation and lateral-phishing attacks. Benchmark studies also demonstrate the predictive potential of deep learning, although differences in datasets, labels and evaluation procedures prevent a defensible universal ranking of algorithms. The principal findings concern dataset representativeness, campaign leakage, temporal generalisation, realistic prevalence, false-alert burden and the connection between detection and organisational action. An explicitly hypothetical sensitivity analysis illustrates how precision can decline as phishing prevalence falls, even when recall and the false-positive rate remain fixed. The article proposes a deployment and evaluation framework combining complementary email features, leakage-aware chronological testing, calibrated decisions, analyst review and governed model maintenance. It recommends evaluating attack subtypes separately and reporting both predictive and operational outcomes. The review concludes that corporate suitability should be demonstrated through representative, time-aware and auditable evaluation rather than inferred from accuracy alone. No new corporate email corpus or trained detection model is reported.