3 ms·
Yes, I've been involved with such a program before, and it definitely helps a lot. Phishing email click rates go way down. This is carefully planned phone-base
by meowface 6y ago
Yes, I've been involved with such a program before, and it definitely helps a lot. Phishing email click rates go way down.
This is carefully planned phone-based spear phishing, though, and that's a lot tougher to protect against. It can be easy for a skilled con artist to gain someone's confidence over the phone, no matter how much you warn about vishing (voice phishing). I'm sure training can still help there, but attackers just keep trying again and again until they find someone it works on.
- zentiggr 6y agoSame principle can apply though. If email phishing can be simulated and used as training, voice can be added to that training drill. Any successful attack vector can be turned into a training scenario and repeated until better responses are trained into the target group. Military casualty drills are very effective at instilling near instinctive responses... same principle applies.
- meowface 6y agoAbsolutely. It's just that highly motivated, targeted, and sophisticated social engineering is really tough to totally prevent. It just takes one person to fall for it, and the attackers can keep cycling through people (quickly, to get ahead of company-wide warnings about the social engineering attempts) until they succeed.