> Clicking a suspected phishing link is a failure, given the absolutely ridiculous amount of potential malware vectors such a site can have. This is absolutely

> Clicking a suspected phishing link is a failure, given the absolutely ridiculous amount of potential malware vectors such a site can have. This is absolutely untrue and it is phishing-vendor propaganda. If there are any "potential malware vectors" from visiting a website, there are so many other ways you are exposed to those "vectors". For instance, Hacker News is a website that features links to arbitrary user-submitted website. Any click on a website on Hacker News could expose you to all the same "vectors." (Maybe that's why nobody here reads the article before commenting?) If an attacker has a way to get malware to you based on your browser accessing some web page and rendering it, they have so many easier ways to do that. They can buy ads leading to the web page they control. They can make organic content that highly ranks a web page they control. They can even render custom iframes inside tweets (https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/player-card https://developer.twitter.com/en/docs/twitter-for-websites/c...) and promote the tweet. If you're concerned about browser zero-days - and you should be! - phishing is the least of your worries. Automatic browser and OS updates with very short remediation times and aggressive policies on BYOD devices staying up to date will get you a lot farther. And these policies are actually genuinely compatible with the jobs of a lot of people who, well, have to click on links to do their jobs. If you fall for the phishing-vendor propaganda, you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't (because their job requires them to), which defeats the point entirely. Hence my question about whether you're measuring results from the phishing vendor, who is incentivized to tell you that paying them is doing something worthwhile, or from actual phishers. Finally, TFA was about spear-phishing and about convincing people to do things, not about distributing malware. A "don't click on links" security culture does nothing to protect against "don't trust emails that tell you to do wire transfers." I have in fact spoken to my security team and convinced them to stop running phishing tests that mark clicking the website as a failure, based on exactly the above reasoning.