> What can be done with the info that user has read, opened and clicked on the website? Follow it up with a much more tailored spear phishing attack - https://

> What can be done with the info that user has read, opened and clicked on the website? Follow it up with a much more tailored spear phishing attack - https://www.knowbe4.com/spear-phishing/ https://www.knowbe4.com/spear-phishing/ Reworked to sales terms: it's the difference between a cold lead and a hot lead. A user who's clicked through has proven themselves to at least be warm or receptive to phishing campaigns in general. As an adversary, I'd probably couple unique links (for tracking clicks) with heatmapping and other front-end tracking technologies to see what exactly the user is doing and how far they've gone before backing out, which helps me refine the attack. Most attackers probably wouldn't go that far (spear phishing the people who clicked would probably be the extent of it), but if someone is after something of particular value at your firm, there's no reason why they wouldn't put more effort into sharpening the attack.