Google’s Matt Linton published an article for a different approach to phishing trainings. Mandatory phishing tests typically collect reporting metrics on sent emails and how many employees “failed” by clicking the decoy link. These tests do have multiple side effects because of the adversarial approach of “catching” people “failing” at the task. After all, humans are social beings and there will always be a way for an attacker to manipulate this. Part of Google’s case rests on a 15-month study with more than 14,000 employees by Lain, Kostiainen and Capkun, which found that embedded training after a click did not make people more resilient, while employees reporting suspicious emails detected new campaigns quickly. Instead of tricking staff, a phishing fire drill announces itself and asks people to practise reporting it, measuring how fast the first reports reach the security team. Back in June the same article showed up here with its sample drill email signed “Tricky. Phish, Ph.D”.
We need to stop doing phishing tests and start doing phishing fire drills