The difference between safety and a data breach often hinges on a single email. But for IT and security teams juggling numerous tasks, creating effective phishing simulation campaigns often falls by the wayside. This oversight, however, can leave your organization vulnerable to sophisticated cyber-attacks. In this post, we delve into the world of phishing simulations, uncovering why cutting corners can be counterproductive and how you can efficiently bolster your defenses. In this post, we cover 3 of the common myths surrounding phishing simulation training campaigns.

3 Phishing Simulation Testing Campaign Myths

Complex Scenarios are the Most Effective

Phishing simulation campaigns can be time-consuming, especially if you’re designing complex campaigns that require a lot of coding and graphics to increase authenticity. While these phishing campaigns are essential, they don’t need to be complex or expertly crafted. Our recent Threat Index report has revealed that social engineering attacks are on the rise. Designing campaigns around attack types that leverage persuasive text will safely expose and train your employees to identify real-world threats. 

Action Item: Develop a diverse range of phishing simulations, from simple to complex. Regularly update your simulation library to include scenarios that mirror recent real-world phishing tactics. Encourage employees to learn how to spot subtle cues in seemingly benign communications. Types of complex phishing tactics to test include: 

• Business Email Compromise 
• Image-based Attacks and QR code (quishing) 
• Spear phishing 

One Size Fits All

With a few exceptions, sending the same phishing simulation training campaign to the entire employee base is ineffective because different departments will face different forms of phishing. For example, your HR team may be more likely to receive fake resumes, your finance team may receive fake invoices, and your marketing team may receive vendor impersonation attempts. Personalizing phishing simulations to the types of phishing attempts departments are currently experiencing makes the training more relevant and effective. 

Action Item:

1. Conduct a risk assessment to identify specific phishing threats relevant to each department.
2. Develop tailored phishing simulations for these groups.
3. Regularly review and update these simulations based on changing roles and emerging threats. 

A Low Click Rate is the Measurement of Success 

While click rates can help you identify the employees who need more training, they’re not always accurate representations. Perhaps an employee missed the email and didn’t open it, but they are still at risk of clicking similar threats in the real world.  

Because of this you should also measure reporting rates. Monitoring reporting rates is an essential metric to measure campaign success and identify phishing risks. The people who reported the email to your team become allies in your fight against phishing.  

Action item: training your staff to identify a phishing threat is only part of the goal. The next step is training them on what to do when they’ve identified a potential phishing risk—report it.