One of the most critical steps in implementing a spear phishing awareness program is to realistically consider the political and cultural environment of the organization, and the implications of this in the development of training scenarios.

Keys to Success

Starting upfront with an open and transparent approach is critical. Coordination with interested portions of the organization, as well as open discussion about the concept with the staff sets the groundwork for an effective training program.

A second key step is to understand the various levels of risk inside the organization. Though all staff that use email are at risk of being attacked and compromised, certain groups may have access to more sensitive information and thus be high targets.

Real attackers will often develop custom spear phishes that specifically target such high-risk groups as executives, finance officers, product development, systems administrators, and M&A groups depending on the situation. We help our customers identify these various groups and develop customized plans on how best to train them through a series of exercises.

Technical Assessment

Our staff also helps our new customers assess the level of technical sophistication inside the firm. Often it is best to introduce the program with relatively simple scenarios first. Then, as the staff’s skills in spotting phishing emails increases, you can ramp up to some of PhishMe.com’s more advanced features and develop even more sophisticated scenarios with further training points.

Developing a Plan for Your Organization

By examining all of these factors, the team at PhishMe helps our customers develop a plan for training scenarios that meets the firm’s specific technical and cultural environment. This can include initial basic scenarios, more advanced general scenarios, unique scenarios for high-risk groups and ‘boutique’ scenarios that can be patterned after actual attacks hitting the organization or your industry today.

NEXT: How PhishMe Works >>

Back to top ↑