We have test-phishing mails sent by our IT-Sec team on a regular basis. There's usually an obvious one and a better made one. First round 10% clicked the obv. one, 99% the good one.

We had a lot of trainings after that.

Last year the numbers went down to 5% and 80%.

If your security concept relies on both of these numbers being zero, you're an incompetent hack trying to shift the blame on end users instead of doing your job.

[–] cron@feddit.org 13 points 4 months ago

Thank you, that was my point! Shifting the blame on the user doesn't help anyone.

[–] hipsterdoofus@lemmy.zip 28 points 4 months ago* (last edited 4 months ago)

In my time as a cybersecurity professional, my approach is always to blame the system, not the person.

If they clicked on a phishing link: 1) that email should never have reached their inbox, 2) that link should never have loaded, and 3) our awareness training is not up to snuff.

[–] Contravariant@lemmy.world 5 points 4 months ago (1 children)

Clicking a link isn't supposed to have side effects, if it does someone else fucked up.

[–] synestine@sh.itjust.works 2 points 3 months ago

Welcome to corporate phishing emails, then, where the page that loads scolds you for being an idiot and submits your name to the boss for automated remedial phishing training, which must be completed lest it also tells HR...