This is a problem that has been bothering me somewhat.

I am able to run a phishing simulation campaign against users across the organisation. If the user clicks on a bad link they are directed and told that they have made a mistake and that they should not have clicked. They are then offered some guidance on what the correct actions should have been through a webpage.

This all sounds great, but how can assurance be given to users it isn't a sophisticated phishing attack?

I have thought about using existing phishing material internally used, and have the link point to the intranet - is there a better way?


You can try the following options:

  • Have someone trusted in the organization warn them that there will be a test that will target the organization.
    This way if they see your message they know that it is a test and all is okay and it is not a sophisticated phishing scam.

  • Add your contact information regarding any questions and that way when they call you can explain to them the situation (You should place this in a visible place on the "You made a mistake" page so they can clearly see it).

  • Maybe I am overdoing it now, but (a) just because they know there will be a test does not mean they know that this is the test, and (b) the contact info could be fake. – Anders Jun 30 '16 at 11:33
  • . (a) - You can post on the page that this is the test that they have been told there will be. (b) Well this would depend on the size of the organization. I was assuming that people know you... – Bubble Hacker Jun 30 '16 at 12:26
  • I agree with the forewarn - I will be sending out reminders before to test the effectiveness of any awareness campaign. Also, including the contact details was something I haven't thought of, which a simple thing to overlook! - Whether they know me or not, is tricky. I could always use a more commonly known contact such as the Service Desk. I think it may be important to not include any further links in the webpage training, and have it as a single page. – Callum McCormick Jun 30 '16 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.