Phishing simulations should test reporting and response, not just click rates
- Severity
- Info
- Sources
- 1
What happened
Opinion piece on phishing awareness programmes. It cites a 2025 Egress study, reported by SC Media, finding that 75% of phishing kits sold on dark-web markets advertised AI capabilities and 82% offered deepfake features. The author argues that identical click rates can mask very different detection outcomes if reporting is poor, so defenders should track reporting rate and time to report, verify unexpected requests out-of-band, and run scenarios such as supplier requests and colleague impersonation. The piece also recommends testing post-report response: message removal, blocking infrastructure, and identifying other recipients who engaged. No CVEs or product versions are mentioned.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Verify unexpected or unusual requests through a trusted channel, even when the message looks legitimate.
- Report suspicious messages through the approved reporting channel without fear of punishment.
- Review phishing simulation metrics to track reporting rates and time to report, not only click rates.
- Rehearse incident response with security, IT, finance and business teams for a successful phishing attack.
Written by AI from the sources, checked against them