Click Here Now: A Positive Way to Create Phishing Awareness
summary
Argues that shame-based phishing simulations fail and instead pilots labeled drills built from real malicious emails and multimodal vectors (WhatsApp audio, Slack, faux-SMS). Runs a vendor invoice drill that should have stopped earlier, measures percent reporting and reporting speed, collects inline feedback, removes public shaming leaderboards, and rewards helpful reports. Results show leadership engagement, actionable changes to reporting UX, and higher trust and practice in realistic scenarios.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:49Shame-based phishing simulations
- 4:20Psychological manipulation in training
- 9:24Fear-based security culture
- 18:37Resilience through drills
- 23:16Positive phishing drills
- 26:26Measuring security programs
- 28:15From fear to curiosity
- 31:42Deputy fishing fighter model
- 32:49Q&A
related talks
52mWho Says Cybersecurity Can’t Be Creative?
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
27mBlunting the Phisher's Spear: A Risk-Based Approach...
44mDeveloping Cybersecurity - How do you make Staff Know Security
05mAn investigation of phishing awareness and education over time: When and how to best
30mGetting Engagement in the Midst of Chaos
12mWhat Motivates and Discourages Employees in Phishing Interventions: An Exploration of
09mBridging the Gap: Developing Accessible Anti-Phishing Solutions