Rethinking employee phishing tests

EMPLOYEE phishing tests have gained popularity as a way for organisations to gauge how vulnerable their employees are to phishing attacks and improve their awareness of cybersecurity. However, some have questioned whether it is appropriate to use 'less shame' and 'methodical simulated phishing tests'.

- ANNA COLLARD

In many sectors a negative reinforcement approach could lead to more effective outcomes.

Why people click

According to a recent study, at least 14% of employees regularly click on phishing emails. This exposure is not only due to a lack of training: employees are often overwhelmed and distracted — which make them susceptible to successful phishing attacks.

A 2021 study, conducted in the UK and US for 2020, backs this up. It revealed that 45% of employees click on phishing emails because of distraction, and that other approaches are more effective than current training. For example, employees are more likely to fall for scams when they appear to be from somewhere in the company or their direct manager.

Critical security