A phishing foothold is the first usable access an attacker gets after a user is tricked into revealing credentials or opening a malicious lure. It is not full compromise by itself, but it gives the intruder a real account, session, or entry point to work from.
This matters because modern networks often trust identity more than devices. With even one foothold, an attacker may inspect email, discover internal systems, abuse weak password reuse, or hunt for privilege paths in Active Directory and cloud identity services. Defenders try to stop the foothold from becoming a bigger breach by using phishing-resistant MFA, alerting on unusual logins, limiting privileges, and watching for rapid follow-on activity such as mailbox access, directory queries, or cloud admin probing.