Skip to main content
20 events
when toggle format what by license comment
Feb 5, 2018 at 10:21 comment added xLeitix As a non-expert I find this quite smart, because it avoids pretending that the tested individuals are the problem, and not the system / culture.
S Feb 2, 2018 at 14:00 history mod moved comments to chat
S Feb 2, 2018 at 14:00 comment added Rory Alsop Comments are not for extended discussion or for answering the question; this conversation has been moved to chat.
Jan 31, 2018 at 22:13 answer added WoJ timeline score: 3
Jan 31, 2018 at 2:34 answer added WGroleau timeline score: 1
Jan 30, 2018 at 21:06 answer added Harper - Reinstate Monica timeline score: 1
Jan 30, 2018 at 14:28 answer added Wadih M. timeline score: 6
Jan 30, 2018 at 14:21 answer added Tom K. timeline score: 49
Jan 30, 2018 at 13:23 comment added WernerCD Hate to continually ask questions: If they deny detailed reporting and the results don't improve... who is culpable in the case of a breech? If you don't give good info - are you at fault? If they refuse the information, are they at fault? In other words - in a year when a breach happens... who is going to get sued?
Jan 30, 2018 at 13:18 comment added schroeder Would they be open to breakdown by department/location/seniority? In my experience, this is extremely useful in helping to narrow in on areas that need help. And this way, you don't have to deal with individuals. Also from experience, I've seen this request before. And it's when the decision-makers don't want to be the ones identified ...
Jan 30, 2018 at 13:06 comment added WernerCD @pm1391 Ongoing... Are there different reports? "8 of 300"... vs detailed breakdowns by, say, repeat offenders? First runs are different than 5th runs - after being warned repeatedly. Is management unwilling to tackle repeat offenders (if you've gotten that far)? THAT would be a bigger issue...
Jan 30, 2018 at 13:02 comment added WernerCD Is this a single run phishing campaign? or ongoing? At a previous company, we had ongoing runs - monthly, quarterly... There were general reports (8 of 300) - and specific reports for management (those who ran the tests could tell who were repeat offenders). There's a difference between "Jill clicked the email once" and "Jill clicked the email 4 times in a row despite repeated classes and warnings"... More than once lead to increased visibility - and consequences.
Jan 30, 2018 at 12:59 answer added Tom timeline score: 22
Jan 30, 2018 at 9:26 comment added jpmc26 "I politely accused them of checking a box and not actually being interested in educating their users." It isn't really possible to do that politely.
Jan 30, 2018 at 7:54 history tweeted twitter.com/StackSecurity/status/958247054337339392
Jan 30, 2018 at 3:56 vote accept pm1391
Jan 30, 2018 at 2:47 answer added McMatty timeline score: 129
Jan 30, 2018 at 1:01 answer added baldPrussian timeline score: 153
Jan 30, 2018 at 0:55 review First posts
Jan 30, 2018 at 4:16
Jan 30, 2018 at 0:53 history asked pm1391 CC BY-SA 3.0