In the current scene of cybersecurity, organizations are constantly seeking ways to strengthen their defenses against cyber threats. One such strategy that has been adopted is phishing tests, a simulated phishing attack aimed at educating employees on the dangers of phishing and improving their ability to recognize such threats. However, the effectiveness of phishing tests has been a topic of heated debate. Drawing from the insights presented in the “2023 State of the Phish” report, let’s delve into both sides of the argument.
The Case FOR Phishing Tests
- Decreased Phishing Failure Rates
- 67% of security professionals reported a decrease in phishing failure rates since the implementation of security awareness programs, which include phishing tests (Page 34).
- Real-World Simulations for Better Preparedness
- Security awareness programs that utilize real-world lures in their phishing simulations can effectively help in assessing user vulnerability to new threats, thereby fostering a culture of vigilance (Page 19).
- Foundation of Security Awareness
- 74% of organizations conduct formal security awareness training, with phishing simulations serving as a vital component in building a robust security foundation (Pages 29-30).
From these stats, it seems like phishing tests are working well.
The Case AGAINST Phishing Tests
- Limited Adoption of Phishing Simulations
- Despite the perceived benefits, only 35% of organizations use phishing simulations, a decrease from 41% in 2021, raising questions about their effectiveness (Pages 29-30).
- Persistent Gaps in Knowledge
- Nearly a third of survey participants were unable to correctly define terms like “phishing” and “malware.” Moreover, around 11% of recipients fell for phishing simulations mentioning common business tools, highlighting the persistent gaps in knowledge despite training initiatives (Pages 5, 6, 10).
- Insufficient Training
- The report emphasizes that training alone, including phishing tests, is not sufficient. It calls for the cultivation of a strong workplace security culture that motivates users to take security more seriously (Page 34).
These responses seem to indicate that phishing tests aren’t nearly as effective as we may think.
The Necessity of a Balanced Approach
The “2023 State of the Phish” report sheds light on the complex narrative surrounding phishing tests. While they have been instrumental in reducing phishing failure rates and preparing employees for real-world threats, their effectiveness remains under scrutiny due to limited adoption and persistent knowledge gaps.
As we navigate this intricate landscape, it becomes evident that a balanced approach is necessary. Phishing tests can indeed be a powerful tool in an organization’s security arsenal, but they should be part of a broader strategy that includes building a strong security culture and continuous education. Random, blind, and downright cruel phishing tests will do the exact opposite of the intended benefit. Instead of strengthening your culture, they will only serve to alienate and infuriate your employees and frustrate your efforts.
As organizations, it is incumbent upon us to weigh the pros and cons and forge a path that ensures both security and education, fostering a workspace that is both secure and aware.
