Yes but the only relevant metric is how many reported it. Doesn't matter if they delete, read, click or enter data. We're only interested in the information that a phish got through our security controls (=we failed our users), so we can investigate (and clean up if needed) the impacted mailboxes and accounts.

[–] brianorca@lemmy.world 2 points 3 months ago* (last edited 3 months ago) (1 children)

No, this is about the fake phishing emails that are released inside the network to test user response. If clicked, they report to IT which users need more training.

[–] faebudo@infosec.pub 2 points 3 months ago

Yes I know. We do simulations but we only measure who reports them and provide training how to report them (In the mail itself). No shaming for user who click them and no additional training on how to look at details.

It makes no sense training the user in looking at for example the links if all the big vendors use suspicious links anyway. For example the phishers use OneNote shares to phish, but those are hosted on Microsoft which by itself is legitimate. The only way a user really is able to recognize a phish is if it is unsolicited (report the mail as spam) or if it looks legit but asks for credentials (report it, we use SSO everywhere possible and you should never be asked for credentials for one of our platforms). We cannot do this for all vendors however and the users are encouraged and trained on using Passkeys or Autofill by the company provided password manager so that they get suspicious when no autofill is possible, then they can report the mail.

It's not always possible to recognize phishing from the get go and security is better suited to investigate than rando from the logistics department.