One in five phishing links clicked by users went completely undetected by legacy URL filtering.