What’s your personal opinion on phishing tests — should cyber professionals rethink this as a method for security awareness training, or is it a necessary practice?
Sort By:
Oldest
CIO2 months ago
I believe that phishing tests are absolutely a necessary practice. Unfortunately, in today's environment, employees are often the weakest link in securing an organization. We need to ensure they are educated on the critical attack methods that potential attackers use, and phishing is at the top of that list. With the use of Generative AI, identifying phishing emails has become more challenging because traditional signs like bad grammar and spelling errors are no longer reliable indicators. If we do not test our people and teach them how to recognize these evolving threats, we will face even greater problems in the future. I do think we need to rethink how we conduct phishing tests, but they are unquestionably necessary.CISO in Banking2 months ago
In my opinion, phishing tests are a necessary practice. We conduct these tests monthly with our employees and plan to continue doing so indefinitely. While the goal of having zero individuals prone to phishing might seem unrealistic, we've managed to maintain a consistent 3 to 3.2% susceptibility rate, which is significantly lower than the national industry average. If an employee does fall for a phishing test, immediate remedial training is provided. We use a tool that makes phishing testing easy and offers a wide variety of templates, ensuring that even two people in the same department don't receive the same email. This helps maintain authenticity and prevents employees from warning each other about the test.COO2 months ago
I don't believe phishing tests are as effective as many think. We're dealing with human beings who have or lack common sense, and that's not something you can account for in a test. Even organizations that conduct frequent phishing tests can still fall victim to ransomware attacks. Cybersecurity is always in a state of catching up with those who are inventing new ways to defeat systems. The best way to protect an organization is to stay informed about emerging threats and make calculated movements. Reactive measures like phishing tests are less effective than proactive strategies like real-time network behavior monitoring.CISO/CPO & Adjunct Law Professor in Finance (non-banking)2 months ago
Phishing tests are necessary as a metric. There are individuals who believe they won't fall for phishing attempts, but we need an accurate way to measure this. While it's impossible to reduce susceptibility to zero, it's important to know where we stand. I often use real phishing emails, recrafted for safety, as tests. This gives me an accurate sense of how many people might click on a real phishing email. If a significant number of people click, it's a sign that we need to prepare for potential attacks.Associate Vice President, Information Technology & CISO in Education2 months ago
I believe phishing tests are necessary and valuable from a metrics perspective. They also encourage the culture of reporting phishing attempts, which is crucial. The quicker a phishing attempt is reported, the faster our cyber teams can react and contain the threat. Even simulated tests provide valuable data on reporting numbers. So, along with everything else that's been said, I believe phishing tests are well worth it.