How are you approaching phishing tests to make sure they really educate folks and aren't just about "tricking" employees?

Security & GRC Awareness & Training Security Strategy & Roadmap+1 more

1.2k views1 Upvote7 Comments

Sort By:

Oldest

CIO7 months ago

We've implemented a Phishing Testing Follow-up Program. The more phishing tests you fail (in one, 12-month rolling period), the more follow-up that occurs. After 1 fail the 'failer' received an education email, is assigned a training, and is on the 'leadership failer list'. After 2 fails, the manager is emailed and on the 'list' again. 3 fails gets you invited to in-person/virtual training with a SME, access is reviewed and removed if appropriate (ie. administrative rights). After 4, we evaluate if the person's role requires receiving external emails and, if not, remove the ability. Lastly after 5 fails, sanctions up to and including termination.

Generally, we're finding that after 3 fails the behavior changes in a positive way.

Principle Consultant in IT Services7 months ago

We have secondary training and re-phishes for people who fail the phishing campaign. We also report the percentage of failures and percentage of people reporting the phish during all hands meetings.

Senior Information Security Manager in Software7 months ago

They have to be done in a formal manner. Great new book with ideas on how to do that. By Roger Grimes, see: Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing.

https://amzn.to/43hTyKd

Please join or sign in to view more content.

By joining the Peer Community, you'll get:

Peer Discussions and Polls
One-Minute Insights
Connect with like-minded individuals

Director of IT7 months ago

Red Team testing is a perfect way to test system and employees. Phishing, mystery guest on the floor trying to get into local network and find hardware and connectivity risks, and real testing based on credentials from phishing.

CISO in Software6 months ago

The most important element is to have targeted and specific training provided to an employee when they "fail" a phishing test.

Content you might like

What’s on your IAM roadmap for the next 18-24 months?

Identity & Access Management (IAM)Threat & Vulnerability Management Security Strategy & Roadmap

Director of IT in IT Services4 days ago

Implementation of Zero trust architecture, its modules across the organisation is a priority for us. So, we will be implementing zero trust strategies in IAM, inline with overall strategy.

1.4k views1 Comment