A significant number of employees are still falling for phishing scams, according to the results of a global test by a Canadian-based firm.
Seven percent of all end users who participated in the 2022 Gone Phishing Tournament run by Quebec’s Terranova Security clicked on the link in the phishing email. Three per cent of them — 44 per cent of clickers — failed to recognize the warning signs on the simulation’s webpage and proceeded to enter their credentials on the malicious site.
“To put these numbers into perspective,” said company chief information security officer (CISO) Theo Zafirakos, “if an enterprise-level organization of 10,000 employees had been targeted with a phishing scam like the one depicted in the simulation, 700 employees would have clicked on the phishing link and over 300 of those clickers would have entered their password, which can be used to compromise systems and sensitive information. Given our reliance on online systems and data to conduct many business transactions and services, this reality is concerning.”
Terranova Security is part of Fortra LLC of Minneapolis. The simulation, which was done in October, was co-sponsored by Microsoft. The annual test, which has a different format every year, saw over 250 organizations in several countries agree to have their employees sent phishing emails. A total of 1.2 million messages were sent in 21 languages.