Does your company do phishing simulations?
Does your company do phishing simulations?
We found out that 10% of our users entered their password.
I'm not in cyber security. My role requires me to interact with a lot of people, work on a bunch of different SharePoint links, and on top of that corporate sends a shit pile of email links to training, peakon surveys, and stuff like that. When I started my new job (3 years ago now), I had a pile of training to do as well as my usual work.
I would be fully focused, keyboard clacking loudly and ding! Email. grumble who the fuck is this now? Oh some stupid training link... wham. Phishing training. Fell for it 3 times.
The whole Microsoft 365 system seems to be quite vulnerable to phishing. Sometimes SSO works, sometimes you need a password, maybe 2FA, maybe not. Many microsoft notification emails come from external sources (with a big banner "this email comes from an external sender, be cautious").
This makes it hard for our brains to spot the small differences that make a phishing campaign successful.
The solution is to suspect every external message and send them all to the phishing mailbox. Tell your boss that you are following the phishing training that you did first.
They will have to get their shit together and send important messages from internal mail addresses. That's just laziness.
I'm 100% so far at my job, but we had one test that tricked somewhere around 30% of employees. They spoofed everyone's supervisor and made it look like an urgent Teams message was pending.
Usually, if you get phished you lose your bonus. They made an exception that one time.