Question

Discuss some pros and cons related to the use of simulated phishing emails as part of cybersecurity training in an organization.

Answer 1

Pros of Simulated Phishing Emails:

• It increases awareness of the phishing and spear-phishing threat. When employees fall for a simulated attack, they become more aware of the real threat and more receptive to the message from the IT security team.
• It improves the general awareness of security. Simulated attack programs help in facilitating the communication between workers and security staff, which in turn helps to improve the efficiency of general security awareness training.
• Simulated attacks allow tracking the effectiveness of security training overtime in the organization
• It helps to focus both the company and the security staff on user behavior and how to turn that weak link into a strength. People can be a weak link in the security chain when it comes to social engineering attacks. Running simulated attacks can help you develop a balance between spending on technology and spending on security training.

Cons of Simulated Phishing Emails:

Phishing simulators, though well-intentioned, can often have a negative effect on employee morale and without coupling to appropriate electronic prevention methods, they may have a questionable benefit on your email security.

Pushing fake phishing attempts into associates' inboxes can strengthen phishing awareness, the thought being that you can draw actionable, discernible data from how your associates react. Consider this though, every phishing attack is completely unique, and each day grows increasingly complex and difficult to discern. How one reacts to a fake call to action on a Tuesday may be completely different as to how they react two weeks next Thursday, and how many phishing simulations will you be able to expose your employees to before the complaints start?

Exposing people to a barrage of fake phishing attacks can have unintended consequences. Otherwise competent and dedicated employees can feel embarrassed and ostracized. Consider, the impact on productivity after a fake phishing attack. Many times, phish fakery negatively conditions employees to the point of ‘analysis paralysis’, often making them less likely to action legitimate emails and in turn tie up IT employees' resources who are now spending time fielding questions on the legitimately of messages that otherwise would have been taken care of.