we need to stop doing phishing tests and start doing phishing fire drills.
That’s the summary of this article on Google Online Security Blog. Much like the regular pre-announced evacuation training instead of surprise drills. The argument leans on a 15-month study by Daniele Lain and colleagues with more than 14,000 employees, which found that embedded training after simulated phishing does not make people more resilient, while a simple report button let the crowd detect new campaigns quickly. Google’s sample drill email is even signed “Tricky. Phish, Ph.D”, which beats a gotcha landing page any day. A September post returns to the same article and its idea of measuring how fast the first reports reach the security team.