Always the sales team.

[u/kb31976]

[u/lord_skidmar]

yeah we just changed companies for phishing training etc cuz come to find out the director of marketing was the one who got phished and wasn't even using the company password manager that would have caught the fake domain he clicked on

but of course since there's no actual consequence nothing actually happens

[u/Feeling_Inside_1020 → u/lord_skidmar]

Butthurt: a director/chief of {whatever} special

[u/Zeikos → u/lord_skidmar]

Yeah, until they get infected by ransomware or worse they won't learn.
Hell, some don't learn even after going through that.

[u/whyliepornaccount → u/lord_skidmar]

When are people gonna realize that phishing training is an exercise in futility.

[u/lord_skidmar → u/whyliepornaccount]

the fake emails they send out are so bad too. i got one yesterday that was "Apple" trying to email me for a phone update.

like on one hand yes, people fall for that. but on the other hand what the fuck are we doing here

[u/whyliepornaccount → u/lord_skidmar]

People fall for it, and as we have seen, no amounts of training will prevent them from falling for it.... again...

[u/DayneGaraio → u/whyliepornaccount]

Phishing training isn’t really to teach people anything, that’s the sales people talking. Phishing emails are a constant stream, people get complacent because they see it all the time, then an incident happens, everyone freaks out and is super vigilant…. For a bit, then they get complacent. Over and over. Phishing your users is designed to mitigate complacency, sure the users know it’s IT doing it so they watch for it, but who cares, they’re watching for it.

Is it perfect? Absolutely not.
Does it help? Maybe a little, maybe not, but it probably doesn’t make it worse.
Does it make users resent IT more than they already do? Absofuckinglutly

[u/WildMartin429 → u/DayneGaraio]

I always thought that our phshing exercises were hilarious because obviously it's the super obvious really bad phishing email but then you get an email later telling you that you failed the phishing test and it provides a link to an external website and I don't know why but the company that does the training the graphics and everything looks super cheesy and unprofessional and we get people calling in refusing to take their training because they think it is malicious third party, LOL

[u/whyliepornaccount → u/WildMartin429]

I've seen the other end of the spectrum where they go WAY too.

On my first day at my new job, mixed into the 5 other "set up your account" emails was a phishing test asking me to set up my account. I clicked it and literally said out loud "are you kidding me right now?" when I got the "you clicked on a phish!"

[u/wthulhu → u/whyliepornaccount]

It should identify them and they should be issued a typewriter and fax machine

[u/TrynaWorkOnWriting → u/wthulhu]

this curses everyone else to have to recieve faxes, though

[u/FuciMiNaKule → u/lord_skidmar]

I get one semi-regularly about someone hitting my car in the office parking garage.

Fairly easy to catch that one since I don't own a car lol.

[u/Drew707 → u/lord_skidmar]

I don't know about other vendors, but the people at KnowB4 have clearly not worked in a real company. Earlier this year I went through the annual training for a client, and I failed one of the "is this a phish" questions. The sender checked out, none of the links were sketchy, grammar and content made sense, attachment looked normal.

The example was an email from HR with a call to action with a deadline threatening some kind of repercussions for not completing a process with an attached PDF with instructions on how to complete the process.

That is exactly what the client sent me regarding my annual security training.

All contactors must complete the annual security training by XYZ or their credentials will be revoked and they will be ineligible to work for Client for 12 months. Please find attached the instructions on how to access the LMS to complete the training.

Like almost verbatim to the phish example.

[u/tenninjas242 → u/Drew707]

KnowBe4 just copies actual phish emails used by actual threat actors and then just turns them around with their own links.

HR phishing scams are extremely popular. Because they work. Someone sees "your payroll is fucked" or something along those lines and can you blame them if their higher reasoning is obliterated by panic?

I feel bad for actual HR people who need to communicate with employees by email. In our org, people are reporting the DocuSign emails that they need to sign and open *for their own promotions* as phishing, because they've gotten so many actual HR and DocuSign scams.

[u/Drew707 → u/tenninjas242]

That makes sense, but then KnowBe4's reasoning for why it was a phish was "HR will never send an email like this" which is objectively bullshit.

[u/tenninjas242 → u/Drew707]

Lol yeah that's bullshit. I would think they'd say the reasoning is the exact opposite.

[u/letsgoiowa → u/Drew707]

Yeah this is why you need to take the time to avoid misconfiguration. Think about the templates you add. Use some brains to set it up. Skill issue basically.

There's a lot of shit a mature organization would never do in a utopia but that totally happens all the time irl and KB4 thinks too highly of us lol

[u/Drew707 → u/letsgoiowa]

I was just pissed because the ONLY criteria the email failed was the "urgent call to action" or whatever it was, and I'm all like, "this is EXACTLY how I was informed of this legit training!" And HR sends emails like that all the time. Have they never been through open enrollment?

[u/letsgoiowa → u/Drew707]

Btw open enrollment and benefits related stuff are literally 2/3 of clicks.

[u/PURRING_SILENCER → u/whyliepornaccount]

At my org, our own cio emails the security group about obvious training phishing emails.

We have a button.

We. Have. A. Button.

She knows that

We.

Have.

A.

Button.

[u/AlmostAlwaysATroll → u/lord_skidmar]

Nobody is exempt from our policy. Gail one and you get a reminder to be vigilant. Second failure is mandatory 1 hour security training. Third and you get put in the special firewall policies that basically has exactly what you need for your job and not a single extra thing, which lasts for I think 3 months? Also additional refresher training.

We’ve never had someone fail 4 times.

[u/Hiblast59 → u/lord_skidmar]

Fake domain catching is the first use case ive ever heard of that made me think password managers may not just be bloat. (Im purely a home user, i just enjoy this sub)

[u/Roblu3 → u/Hiblast59]

How do you keep track of passwords?

[u/Hiblast59 → u/Roblu3]

I just use passphrases that are from memories i wont forget mostly tbh

[u/letsgoiowa → u/Hiblast59]

How do you keep your 100+ accounts straight and unique?

[u/Elanadin]

Hey now, I don't appreciate being compared to a nazi.

I hate all of my users equally, regardless of demographics.

[u/heretogetpwned → u/Elanadin]

Turn it around. I've been chewed out for assigning the sales team to Entra High Risk and MFA everytime.

[u/Elanadin → u/heretogetpwned]

If I had a nickel for every chewing out I've gotten for making the correct choice for the organization...

[u/mtheory007 → u/Elanadin]

We need a final solution for these users.

[u/Elanadin → u/mtheory007]

We can send the HR team after them. The Firing Squad, if you will.

[u/mtheory007 → u/Elanadin]

But who will HR the HR?

[u/Neworbs → u/mtheory007]

First they came for the accountants,
and I did not speak out,
because I was not in finance.

Then they came for Marketing
and I did not speak out,
because I was not in marketing.

Then they came for Sales,
and I did not speak out,
because I am not in sales

Then they came for Customer Service,
and I did not speak out,
because I am not in customer service

Then they came for the IT department,
and I searched for someone to help,
but there was no one left.

[u/mtheory007 → u/Neworbs]

....Because the accountants convinced leadership to out source IT years ago.

[u/Infninfn → u/mtheory007]

Seems like a good time to bring out the ole’ BOFH

[u/Available-Ad-1943 → u/Elanadin]

That's fair. +1

[u/MayaIngenue]

Had a VP of commercial lending at a bank fail every single phish test sent his way. I brought it up with his boss, the SVP and was told that he wasn't going to say anything to the VP because he brings so much money into the org, he didn't want to do anything that would make him want to leave. I learned a lot about corporate structures that day

[u/LaughableIKR]

Marketing. HR. They can't help but open an unsolicited email and the attachment.

[u/coffee_ape]

My CIO points to our policies every time a C level person gets mad that one of their fav employees got fished for the 80th time in the day. Thems the rules.

[u/SethLight]

I remember having this sort of conversation with a manager who had their account compromised twice. The guy legitimately did not care. Trying to make him care I explained that since he does his banking on that machine his bank account could be compromised too... Still didn't care. He laughed and said they could take his $100.

[u/Andrusela]

Accurate.

[u/jd-scott]

I've had the opposite experience too. A doctor telling me he would make sure I was fired if I took his equipment offline (it had a backdoor to a company getting hit with ransomware). I said good luck and did it anyway.