Alt text: Michael Scott Handshake meme. Managers text: “My company Congratulating me on avoiding a phishing test email”. Michael Scott text: “Me, terminally behind on answering email.”
Alt text: Michael Scott Handshake meme. Managers text: “My company Congratulating me on avoiding a phishing test email”. Michael Scott text: “Me, terminally behind on answering email.”
The IT people send out the phishing mail themselves as part of a test. It isn’t an actual phishing mail, just something made to look and act like one. In the end they have a report which people fell for it, which ignored it (or were ooo) and which reported it.
Reporting is done via the report phishing feature in Outlook. For consumers it’s sent to Microsoft, but for businesses you can configure those reports to do what you want. It’s actually a really good feature and people should always use it.
Does your IT team tell you that they’re performing the test and to report, or is reporting phishing always constantly recommended. I’ve managed a small org ( <100 ) email server and we tried to have people report suspicious emails and it was so much noise and wasted so much time. Of course the CEO isn’t requesting you buy gift cards, what am I going to do about it. I’d say the money would be better spent on a better system rather than hope one human forwards it to another human.
They don’t tell us they are testing, it’s done at random. Reporting is policy, it needs to be done with every phishing mail that gets past the filters. It’s one of the big ways a company is vulnerable, an employee clicks on a link in a mail, opens something they shouldn’t and before you know it there’s been a databreach. I don’t think they are especially worried about the employee leaking his personal info, they are worried about targeted attacks and corporate espionage.
I’m sure there are a lot of false positives. Even though I work in a technical company, we have plenty of people who aren’t as handy with tech. People get training regularly and if one person reports a lot of useless I’m sure they will train that person extra. I think for a lot of people except maybe sales something like 80% of all mail is internal. And the other part is probably 50% repeating automated mails. So the number of mails that could even be phishing are limited. It’s a mid sized company with about 1000 employees.
I see the benefit of reporting to catch false negatives of the filters, but in reality, if I received more than one report in a week or two, id consider a new system for scanning. A 20% false negative rate is pretty bad. Most emails should be easily identified, and I think it’s unreasonable for end users to check if the sender domain name is newly registered, has utf-8 characters which look like ASCII characters, etc. The metric for success shouldn’t be a high number of end users reporting phishing emails, but that seems to be what upper management wants to see, which just incentives less resources invested in better scanners with less than a 20% false negative rate.
The eternal battle between the “oh we go by data backed metrics, much measured, I feel this is the best” executive suite and the poor saps beneath twirling the data backed signs going ignored until money or disaster strikes.
Pity businesses aren’t formed from the bottom up; it’s like an octopus deciding not to listen to its arm brains until the shark has a bite of its head.
Sounds like your email software needs fixing…
Sure let me go tell Microsoft