Failing the Phish Test

Phish testing your employees is a vital part of any security awareness program. It seems logical that by exposing employees to phishing and helping them identify tactics, the chance of anyone in your organization to be phished lessens. But does it?

When employees who failed phish tests are called out, made to feel poorly or singled out in a group the exact opposite can happen.

End users are the largest, most vulnerable target in most organizations. In real-world attacks, end users are relentlessly bombarded with spear-phishing and socially engineered schemes.

As the champion of your organizations cyber security, it is imperative that these tests be used as teachable moments to educate and encourage your end users.

Use Failure as a Teachable Moment.

Look at the failure of phish testing in a different light: you’ve identified a weakness in your security that can now be remedied.

Effective Phish Testing Checklist

Every phish test should follow some basic tenets in order to educate users:

The links in a phish test campaign should go directly to a site with immediate education.
Do not call out or embarrass users who fail the test. Public shaming results in decreased threat reporting.
Do not tie user responses to employee evaluation testing. Doing so can can create resentment towards security, which is not good for the organization.
Offer encouragement and education by directing users to additional training. This can be optional or required depending on how many times the user has failed.
Provide additional written materials such as articles and information from other sources.
Reward people who report incidents. This can be as simple as a kudo’s in the company newsletter or even prizes and contests. Make sure that your organizations culture gives positive support to employees who report incidents.

Protecting Your Network

JDL Group can help you put in place the right cyber security measures for you and your organization. If you want to learn more about protecting yourself and your employees from phishing campaigns check out our free anti-phishing toolkit.