3 ms·
Related: is there any evidence that this sort of testing actually works (reduces engagement with genuine phishes/spam)? Corporate information security training
by dave4420 3y ago
Related: is there any evidence that this sort of testing actually works (reduces engagement with genuine phishes/spam)?
Corporate information security training feels like someone guessed at what should work, without checking that their hunch was right.
- LinuxBender 3y agois there any evidence that this sort of testing actually works Yes. I don't have the reports and graphs and would not be permitted to share them even if I did, but I worked for a company that handles as-sensitive-as-it-gets data. We did phishing tests multiple times per year. A percentage of people would click on the links and a sub-set of them would enter corporate credentials. Those employees were required to attend security training. There were incentives for leadership to get the numbers down and down they went year over year. The greatest focus on re-training was applied to those with access to customer data, production and development environments. I do not have an answer for OP's question however. I think lawyers and legal agreements would be required for people outside of a company that have not signed vaguely worded terms of employment documents. I personally would not perform such testing at the risk of landing in the bog of eternal stench. a legal quagmire