How do you handle false positives and negative feedback from phishing simulation tools?

There's nothing worse than a poorly implemented phishing simulation program that demotivates and demoralizes employees. It is important to build a program that offers constructive and positive feedback while also highlighting the success of those employees that are able to spot and avoid phishing emails.

This section is a little bit of a misunderstanding by the AI that helped create it. Phishing simulation tools do not flag emails as phishing, they send simulated phish. I think the AI must’ve confused simulation tools with detection tools.

Justement l'outil ne devrait pas taguer les e-mails légitimes puisque c'est une campagne de phising créé par l'outil... Qui ne doit pas les taguer non plus ?? #cybersécurité

It is virtually impossible to control all false positives and false negatives in phishing simulations. Here are some variables at play: - Security filters blocking simulation messages (false negative) - Security filters that “detonate” links in incoming messages (false positive) - Employees “spot the test” in subject lines (false negative) - Curiosity or rebellious employees, not lack of awareness (false positive) - Employees on leave (false negative) - Employees warning others about phishing test messages (false negative) There are more… Don’t get too hung up on tracking click rates to any degree of precision. Reporting rates should be the target.

By implementing key best practices, which is to Monitor and Analyze Feedback: Carefully monitor and analyze feedback from employees who participate in phishing simulations. Provide avenues for them to share their experiences, concerns, and suggestions. By actively listening to their feedback, you can identify areas for improvement, address any false positives, and continuously refine your phishing simulation program as well as minimize false positives and negative feedback from phishing simulation tools while effectively enhancing your organization's security posture and employee awareness.

L'implémentation de campagne de phising doit se faire avec l'accord de de la DRH afin de sensibiliser le personnel aux bonnes pratiques. Après les faux positifs il faut les mesurer et les analyser en fond de taches pour se faire une idée de la progression des collaborateurs... Car là sensibilisation ne suffit plus il faut passer à la pratique même avec un retour de faux positifs conséquents

Tout comme on passe des séries de questions avec diapo/photos/vidéos pour le code de la route, il faudra la emme méthodologie de formation pour les collaborateurs au sujet du phising. +80% des cyberattaques ont une origine humaine défaillante... Il faut former à défaut de sensibiliser.

When you prioritize comprehensive security awareness training for employees, ensure they understand the purpose of phishing simulations, the potential indicators of a phishing email, and how to report suspicious messages. By enhancing their knowledge and awareness, employees can better differentiate between genuine emails and simulated phishing attempts, reducing the chances of false positives.

L'engagement des collaborateurs sur les bonnes pratiques en cybersécurité c'est de montrer l'avantage pour eux, comme le code de la route à obtenir... Une reconnaissance pour ceux jouant le jeu afin de se sentir valoriser et d'accéder à des r?les + importants comme référent cybersécurité par exemple

Some best practices for incorporating phishing tools into your organization include: 1. Provide context and explain to employees why phishing attacks are a threat and how they can impact the organization. 2. Customize the simulations to the specific threats your organization and your employees face. 3. Offer guidance to your employees on what to do, who to contact, and what steps to take to protect their accounts. 4. Track progress and use metrics to see the effectiveness of the phishing simulations over time.

Considering the inconsistent/imprecise data, the potentially unexpected outcomes from employee reactions, and the costs of trying to create meaningful scenarios, phishing simulations should not be over-used or made too elaborate. You can easily reach a point of diminishing returns, even though they are theoretically a real test of risk decision-making by employees. Running less frequent simulations with less contentious or elaborate scenarios, together with immersive, gamified phishing exercises that can illustrate more complex scenarios without damaging corporate culture will provide more educational and assessment value in the end.