Quick answer: In cyber security, SLAM stands for Sender, Links, Attachments and Message. It is a four-step checklist for spotting phishing emails: check who really sent the email, where the links actually go, whether the attachments are expected and safe, and whether the message itself shows warning signs such as urgency or unusual requests.
Phishing remains one of the most common ways attackers get into organizations, and most phishing still arrives by email. The SLAM method gives employees a quick, memorable routine to run before they click. This guide explains each step and how to use SLAM in training.
The SLAM checklist at a glance
| Step | What to check | Red flags |
|---|---|---|
| Sender | The full email address and domain | Misspelled domains, free email accounts, display name that does not match the address |
| Links | The real destination behind each link | Shortened URLs, lookalike domains, links to login pages |
| Attachments | Whether you expected the file and its type | Unexpected invoices, macro-enabled documents, archives, executable files |
| Message | Tone, request and context | Urgency, threats, requests for payment or credentials, unusual wording |
No single check catches every phishing email, but together the four steps catch most of them. The method works because it slows the reader down at the exact moment attackers want a fast reaction.
S: Check the sender
Look at the full address, not only the display name. Attackers register domains that differ by one character or swap letters, such as “rn” for “m”. Be wary of messages from a personal account claiming to be a colleague or supplier.
L: Inspect links before clicking
Hover over a link on a computer, or press and hold on a phone, to see the real address. The visible text can say anything. If a message asks you to sign in, go to the site directly instead of using the link.
A: Treat attachments with caution
Unexpected attachments are a common malware delivery method. Be especially careful with Office files that ask you to enable macros; our guide to phishing prevention and training explains why. When in doubt, confirm with the sender through a separate channel.
M: Read the message critically
Phishing messages create pressure: an account will be closed, a payment is overdue, the CEO needs gift cards now. Generic greetings, odd phrasing and requests that break normal process are all warning signs. AI tools have made phishing text more polished, so rely on the request and context more than on spelling mistakes.
How to use SLAM in your organization
- Teach SLAM in onboarding and add it to your security awareness program.
- Run simulated phishing exercises and debrief using the four steps.
- Give staff a one-click way to report suspicious emails.
- Back human checks with technical controls such as email filtering, DMARC and phishing-resistant authentication.
CISA’s guidance on recognizing and reporting phishing covers the same warning signs. Phishing is only one form of manipulation; see our overview of social engineering attacks and the newer threat of deepfake voice phishing.
Frequently asked questions
What does SLAM stand for in cyber security?
SLAM stands for Sender, Links, Attachments and Message. It is a checklist used to identify phishing emails.
Is the SLAM method enough to stop phishing?
No method is perfect. SLAM reduces risk by helping people spot warning signs, but it should be combined with email filtering, multifactor authentication and a reporting process.
What should I do if an email fails the SLAM check?
Do not click links or open attachments. Report the email to your IT or security team, then delete it.
Does SLAM work for text messages too?
Yes. The same questions apply to SMS and chat messages: who sent it, where the link goes, what is attached and what the message is asking you to do.
Conclusion
The SLAM method turns phishing awareness into a habit that takes seconds. Teach it, practise it with simulations, and support it with technical controls, and most phishing emails will fail at the first check.
