How Phishing Simulations Can Build Employee Resilience
Summary
Huntress describes using varied monthly phishing simulations to expose human vulnerabilities, coach repeat clickers, and measure how quickly employees report suspicious messages. It recommends treating failures as learning opportunities rather than reasons for reprimand
Key points
- The article frames phishing simulations as a way to identify and address weaknesses in an organization's human attack surface.
- Rotate psychological tactics and lures to prevent employees from anticipating a predictable monthly test.
- Use repeated failures to identify employees who may need individualized coaching; treat single failures as learning opportunities.
- Measure how quickly employees report simulations, since early reporting can enable response actions such as removing messages from inboxes.
- Huntress reports that its January generic lures produced about a 2% click rate and February internal-conferencing lures about 4%.
- After a month with a higher click rate, the organization saw a sharp decline in subsequent months; the author recommends responding with empathy rather than reprimanding employees.
Article Details
- Topic
- Using regular phishing simulations to improve employee awareness, resilience, and reporting of suspicious emails