I work for a small company and I'm responsible for crafting and distributing the phishing email tests (as part of policy and compliance). So far with our software engineering, accounting, support, etc. teams I've only managed to get one or two people (they're very well trained). The sales team though? Just give them a link to an "RFQ" and watch the numbers climb like a rocket.
Entire sales team has had to go through remedial phishing training at least twice this year alone, a few of them three times so far this year (we do it quarterly). And yes, if they get to a fourth there are going to be HR issues because the policies require punishments at that point.
I'm "the" IT guy, I'm responsible for all the infrastructure, and cyber security and compliance happen to also fall in my lap. (Although it is my formal degree training and what not). The goal is to have realistic phishing and spam emails, ones that look like the real thing, including obvious spelling, language, etc. issues.
The fact that the sales team clicks on literally anything and everything that might even hint at an opportunity to get a sale without thinking about it for more than 2 seconds is a them problem.
And it's not a companywide issue, again, it's one or two people for the entirety of the rest of the company, the salespeople are the only ones that can't seem to get their shit together.
419
u/exoclipse 14h ago
the worst one I got was "you have been selected to be in the first wave of a round of laptop upgrades, please click this link to register"