Why does nobody talk about how easy phishing tests are to fail?

I work at a small credit union in Dayton and last month our IT guy ran a fake phishing email test. 62% of our staff clicked the link, including me honestly. The kicker was the email said 'urgent password reset' and came from a domain that was one letter off from our real one, like 'creditunion.co' instead of '.com'. I thought I was careful, but the panic took over. Has anyone else seen numbers that high in their own workplace?

1 comments

1 Comment

smith.jordan22d ago

That domain trick is actually a common one, but the real issue is that those tests are built to exploit panic, not measure how careful people normally are.