In my company spam emails are becoming a real headache. Since the number of employees is growing rapidly, the email accounts are to. We have managed to take security measures in a technical point of view(AntiSpam, Firewall etc...) but we are not doing very well in the social engineering part.

We are sending periodically emails to all the employees NOT TO CLICK LINKS COMING FROM UNKNOWN SENDERS and explaining to them the damage of the action, but it doesn't have the desired effect.

Is there a better strategy we can use to reduce maximally the clicking of these emails?

  • 1
    You do realise that there is an entire branch of security that deals with this sort of thing? "Security Awareness" is an entire field of study to answer this question.
    – schroeder
    Commented Oct 28, 2016 at 16:58
  • I do. But i was hoping in an overview only regarding to this specific problem, spamming via mail. Because this is the main problem we are having.
    – Vini7
    Commented Oct 28, 2016 at 17:06
  • people's recall improves with motivation. you could have contests on the first/most spam flagged. positives nestle in different memory locations than negative punishments, increasing recall.
    – dandavis
    Commented Oct 28, 2016 at 19:04
  • Make bonuses contingent on how many security violations users have or have not accrued over the course of the year.
    – Ivan
    Commented Oct 28, 2016 at 19:48

2 Answers 2


Yelling at employees rarely results in people engaging in the desired behaviour. Make no mistake, your goal here is the changing of their behaviours, not convincing them of a fact.

First, you need to make sure they know what to do when they receive an email with a link (hover and read).

Second, you need to give them a chance to practice this new behaviour in a safe setting (training materials, lectures, practice software).

Third, you need to support them when they are faced with their inbox alone.

Simulated phishing campaigns can help if you use the correct context (education instead of punishment).

I would also suggest having your email server include text at the top of emails from external sources highlighting the fact that the email is external.

Remember, you need to support and encourage people to engage in the behaviours you expect from them, especially when that behaviour is voluntary (like handling links in random emails).

  • 1
    My profile info includes a book and my blog that covers other tips, ideas, and techniques to deal with security awareness struggles.
    – schroeder
    Commented Oct 28, 2016 at 17:07

It would be really great if you have an awareness training program incorporated to your appraisal process.

  1. For appraisal, the employees must complete the computer based training module for phishing and internet attacks.
  2. They must also pass the test which verifies whether they are actually applying what they learned. For this you can use the social engineering toolkit and create phishing emails once in a while and send this to all the employees. Based on the results including who clicked, you can articulate the risk to higher management.

The higher management will definitely be concerned if the results are bad and that will help.

PS: Having a spam filter in place reduces this issue to a great extend.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .