3 ms·
If the study was done with target consent, it might be biased with inflated click-through rates due to the targets expecting benign well-targeted spear-phishing
by cluckindan 2y ago
If the study was done with target consent, it might be biased with inflated click-through rates due to the targets expecting benign well-targeted spear-phishing messages.
If it was done without target consent, it would certainly be unethical.
- neom 2y agoThey got IRB approval. The authors framed the emails as part of a marketing study involving "targeted marketing emails."
- jt2190 2y agoIt seems like “the subject clicked a link in an email” is equated to “being phished”, but I’m not certain that is a good definition.
- Terr_ 2y agoI'm certain that someday I'm going to be dinged on a really shallow kind of work security test because I decided to investigate a link into a sandbox/honeypot environment.
- RaptorJ 2y agoThese phish testing companies always stick a header (X-PHISH-TEST or some such) on the email so the email server can white-list -- easy to just Outlook blackhole filter anything with that header after you've seen one test.
- Terr_ 2y agoWhat stops an attacker from abusing the same header? It could be kinda-secure if the header had to have a payload which matched a certain value pre-approved for a time-period. However an insider threat could see the test going on and then launch their own campaign during the validity window.