How live phishing test click rates can easily be skewed
People who don’t open live phishing test messages, don’t count. Well, what I mean is that it’s inaccurate to call this a “pass”. Whether they even see the message at all often depends on the subject line, and how it resonates with an individual.
How can we use that data if we don’t know why they didn’t open it? Did the employee recognize the email as a test, just by seeing the subject line?
If an employee recognizes the subject line as a likely phishing test, that may be a good thing. But, if we don’t know “why” they didn’t open it, we can’t assume they are capable of spotting other key elements of phishing threats.
Different message subject lines will resonate differently with each employee. For example:
– Do they want “concert tickets”?
– Have they already done their holiday shopping?
– Did they just get a payroll deposit, and the subject is suspect?
– Does subject line only matter to some in the organization?
Photo by Markus Spiske on Unsplash
[/et_pb_text][et_pb_cta title=”It’s been a “super-fantastic” experience to see people learning and talking about security threats.” button_url=”https://clickarmor.ca/quick-start-bundle-gamified-security-awareness-training-and-engagement/” button_text=”Start Your 6-Week Quick Start Bundle Now” _builder_version=”4.16″ _module_preset=”default” locked=”off” global_colors_info=”{}”]For just $325 USD, you can run a 6 week, automated program for gamified phishing awareness training and challenges. (Limited time offer. Normally valued at $999 USD)
Use Promo Code: 6WEEKS
[/et_pb_cta][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”4.16″ custom_padding=”8px|||||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ global_colors_info=”{}”][et_pb_text _builder_version=”4.17.6″ text_font_size=”20px” text_line_height=”1.8em” header_2_line_height=”1.4em” min_height=”8px” custom_margin=”-20px|||||” custom_padding=”22px||0px|||” global_colors_info=”{}”]These are the kinds of questions that organizations need to consider within each and every live phishing test campaign.
How compelling should the subject line be? This deliberation takes a lot of time and effort, which many organizations don’t recognize. What we decide to put into the subject line has such a great effect on whether the employee even opens the message, that the “click rate” will be far from accurate.
This means there is only marginal value in tracking a trend based only on “click rates”. When you think about it carefully, how much does the “click rate” really mean when the subject line itself can skew the data a lot? And how do you measure employees’ ability to spot other elements of phishing attacks if the “click rate” is the only thing we know?
We need a more accurate and reliable way to measure employees’ capabilities for spotting threats, to manage their vulnerability.
[/et_pb_text][et_pb_button button_url=”https://clickarmor.ca/trial” button_text=”Book a free trial of Click Armor to start strengthening your security culture” button_alignment=”center” _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][/et_pb_button][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]
Scott Wright is CEO of Click Armor, the gamified simulation platform that helps businesses avoid breaches by engaging employees to improve their proficiency in making decisions for cyber security risk and corporate compliance. He has over 20 years of cyber security coaching experience and was creator of the Honey Stick Project for Smartphones as a demonstration in measuring human vulnerabilities.
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”4.16″ global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ global_colors_info=”{}”][et_pb_post_nav prev_text=”Previous Post” next_text=”Next Post” _builder_version=”4.16″ title_text_color=”#ffffff” background_color=”rgba(14,79,136,0.68)” custom_padding=”5px|10px|5px|10px|true|true” border_radii=”on|4px|4px|4px|4px” border_width_all=”1px” global_colors_info=”{}”][/et_pb_post_nav][/et_pb_column][/et_pb_row][/et_pb_section]