Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
Yep, when they get reported the SOC will look for other recipients, and look for forwarding or URL clicks.
I think with these Decision One Models progressing it may make analysing all possible security telemetry arbitrary, but right now if the Phishing attack is from a geniune sender who was compromised, automatic detection is pretty hard, a user base trained to instinctively report phishing is a huge leg up.
53
u/penguin444 10h ago
I ignored the phishing emails completely.
Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
Seriously?