Phishing Simulations: Effective Defence or Just Security Theatre?

Phishing simulations are all the rage in cybersecurity training, but are they truly effective or just another box-ticking exercise? Businesses are spending thousands on these programmes, hoping to safeguard against phishing attacks. Yet, with mixed results, it’s worth asking: are phishing simulations a genuine defence mechanism or mere security theatre?

The Case for Phishing Simulations

Phishing simulations can be a vital tool in educating employees about cyber threats. They mimic real-world phishing attacks, testing how employees respond to suspicious emails. This proactive approach helps organisations identify vulnerabilities and develop targeted training.

For instance, companies like KnowBe4 and Cofense (formerly PhishMe) offer subscription-based services priced per user, per month. They provide a wide range of phishing scenarios, from fake invoice requests to impostor executives. The idea is simple: the more familiar employees are with phishing tactics, the less likely they’ll fall for them in real life.

A well-executed simulation can reveal which employees need further training, allowing for a more tailored educational approach. Over time, employees become more vigilant, knowing that any email could be a test. This, in theory, should reduce the risk of a successful phishing attack.

The Criticism: Security Theatre?

Despite their potential benefits, phishing simulations have their critics. Some argue that these exercises create a false sense of security. Employees might become adept at spotting simulation emails, yet still fall for a sophisticated real-world attack. After all, simulations can only replicate known threats, not emerging ones.

Moreover, the focus on individual failure can be problematic. Employees who fail simulations may feel unfairly targeted, leading to a culture of blame rather than collaboration. This can result in decreased morale and an environment where employees are hesitant to report real phishing attempts for fear of reprisal.

There’s also the issue of cost. Smaller businesses, already stretched thin, might find the expense of these programmes difficult to justify, especially if the results are inconclusive. While large corporations might absorb the cost, smaller organisations may wonder if their limited resources are better spent elsewhere.

Finding the Balance

So, how should a small to mid-sized business in Toronto approach phishing simulations? The key is balance. These simulations should be one part of a broader cybersecurity strategy, not the sole focus.

Combine with Other Measures

Phishing simulations should be combined with other security measures, such as:

• Regular Security Training: Beyond simulations, offer comprehensive training sessions that cover a range of cybersecurity topics.
• Advanced Email Filtering: Invest in robust email security solutions. Products like Cisco Secure Email or Microsoft Defender for Office 365 can help block phishing attempts before they reach employees.
• Incident Response Plans: Develop and regularly update a response plan for when (not if) a phishing attack occurs. Employees should know whom to contact and what steps to take.

Foster a Supportive Culture

It’s crucial to create an environment where employees feel comfortable reporting potential threats. Reward vigilance, not just successful simulation outcomes. Encourage open communication and reassure staff that security is a shared responsibility.

Evaluate and Adapt

Regularly assess the effectiveness of your phishing simulations. Are employees improving over time? Are real-world incidents decreasing? Use this data to refine your approach. What works for one organisation might not work for another, so be ready to adapt.

How We’d Approach This

At Innovate NorthTech, we view phishing simulations as a valuable tool, but not a standalone solution. We’d start by assessing your current cybersecurity posture, identifying specific vulnerabilities, and then integrating simulations into a comprehensive security strategy. Our focus would be on creating a supportive environment that encourages collaboration and continuous learning. We believe that with the right balance, phishing simulations can be a useful part of your defence toolkit, helping to protect your business against evolving threats.