Matt Linton 
Looks like this person got a visit from the ghost of cybersecurity "foreseeable consequences".
"I harassed my users into not opening any emails they aren't expecting, and now they won't open any emails they weren't expecting!"
postmodernPhishing Simulations considered ineffective. Implement 2FA, etc instead.
https://www.computer.org/csdl/proceedings-article/sp/2025/223600a076/21B7RjYyG9q
If you're still stuck doing pointless Phishing Trainings, there's one weird trick to never be bothered by them ever again. Email filter rules! Just add email filter rules to your email client of choice that checks for these email headers which indicate it's a phishing test and automatically move the email to Trash. Presto, no more phishing tests.
https://github.com/postmodern/phishing-training-sigs
#phishing #phishingtraining
https://github.com/postmodern/phishing-training-sigs
#phishing #phishingtraining
Now that Google is finally phasing out Phishing Trainings in favor of Phishing Awareness, hopefully all of the startups that mimic whatever Google does will also follow suite and end this ridiculous security theater.
However, there's something even better than Phishing Awareness: setting up controls to make Phishing useless. Require 2FA on every account. Give your employees YubiKeys. Setup mail server filter rules to move any email not on your known-domains-we-do-business-with list to the user's junk/ folder.
https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html
#phishing #phishingtraining
InfosecDogeHey #InfoSec community! I'm on the fence about phishing training β not a big fan due to the risk of breeding mistrust and complacency. But, I'm all ears for data-driven insights.
Got any studies or personal takes on simulated phishing campaigns? Would love to hear both sides to shape some strategies and docs.
Evidence-based studied would be a great help!
Thanks! π‘οΈ #CyberSecurity #PhishingTraining
Eric Stein οΏ½Logged into my online banking and they immediately *emailed me* with a link to click to "see my security level" whatever the hell that is. My security level is "doesn't click links in emails that are allegedly from my bank", thank you very much. #PhishingTraining #BankOfAmerica #PleaseGetUsedToClickingEmailsAndProvidingYourBankingPasswordThatsSurelyFine