3 ms·
In my experience (at a large institution) these phishing tests haven't flagged a user until personal info was actually entered, or some other vulnerable action
by ericpauley 9y ago
In my experience (at a large institution) these phishing tests haven't flagged a user until personal info was actually entered, or some other vulnerable action was taken. Seems like there would be so many false positives otherwise.
- jedberg 9y agoMaybe they’ve gotten better since I started ignoring them. But back in the day they flagged you the moment you clicked.
- holdmywaffles 8y agoAs a security goon, you get pretty detailed reporting on who did what with the email... but you have to decide what to do with it. Punishing and mocking people doesn't work. A good head of security should be _excited_ for someone who's interested in digging deeper. There's a lot of talk in our field about outreach for security-minded devs and sysadmins (usually called a security champion program).