2 ms·
I’ve never ever run a phishing campaign against a medium+ sized organization and had zero hits. It’s great that you think you could never be conned, but I’d be
by wepple 3y ago
I’ve never ever run a phishing campaign against a medium+ sized organization and had zero hits. It’s great that you think you could never be conned, but I’d be interested if you think that scales to your entire security team.
A well-timed, creative phishing campaign can include things like a “regarding your employment status” right after the company announces layoffs, if you’re talking malicious actor and not watered-down security awareness exercise
- worksonmine 3y agoWe are all very aware of what to watch out for and I trust that anyone with dangerous access is aware, but we're a small shop. I know that humans are the weak link, but my definition of a "seasoned security professional" is not the average Joe that would fall for it. Will some security people fall for it? Absolutely, but they don't deserve the title "seasoned". Especially not if always being cautious of phishing is part of their training/on-boarding. I'd say it makes that rule essential instead of useless.