Phishing simulation training is a staple of many security awareness programs. In the latest State of the Phish annual research report by security company Wombat, 76% of information security professionals reported that their organizations were victimized by phishing. It is also big business. The firm Cybersecurity Ventures is predicting that “global spending on security awareness training for employees is predicted to reach $10 billion by 2027.”
As the cat and mouse game continues, hostile actors have improved their tactics by impersonating business partners and government agencies which has forced organizational programs to retool their programs as well. Some companies with more mature awareness programs have even evolved to include phishing simulation campaigns on regular intervals targeting various segments of an organizational population to ensure proper testing penetration and effectiveness.
However, one area of phishing simulation training that may not have matured is the end game. Once the metrics are analyzed, what do you do with the repeated clickers? Common follow-up actions include additional training and notification to management. In many cases, no action is taken at all.
There could be multiple reasons for this such as not wanting to embarrass employees, push something that could be counter to the company culture or lack of resources to track and monitor any follow-up actions.
This presents a large gap in the training cycle and puts the organization at risk. Especially since according to a report by security software company PhishMe, 91% of cyber attackers were initiated by a phish. This is primarily due to the fact that it is such an attractive attack vector for hackers. Furthermore, if employees ultimately know there will not be any consequences to their action, why would it improve? Employee accountability stems from enforcement and if needed, escalation, otherwise, phishing simulation training has minimal value.
Ultimately, to fix the problem, it boils down to the tolerance level for failing the exercises and understanding the importance of correcting the behavior. Implementing a formalized escalation process for test failures would help to complete the life cycle for the phishing simulation training program.
Here is an example of how an escalation process would run during a 12 month period assuming multiple campaigns are conducted.