To click or not to click

Issue 1 2022 News & Events

The study, 'To click or not to click: What we learned from phishing 80 000 people', which included 82 402 participants, tested how employees from four different organisations responded to emails that simulated one of four commonly used phishing tactics.

22% of recipients that received an email simulating a human resources announcement about vacation time clicked, making emails that mimic those sent by HR the most frequent source of clicks in the study.

An email asking the recipient to help with an invoice (referred to as CEO fraud in the report) was the second most frequently engaged with email type, receiving clicks from 16% of recipients.

Document share (notifications from a document hosting service) and service issue notification (messages from an online service) emails received clicks from 7% and 6% of recipients, making them the least frequently clicked emails in the study.

However, according to Matthew Connor, F-Secure service delivery manager and lead author of the report, the study’s most notable finding was that people working in ‘technical’ roles seemed equally or even more susceptible to phishing attempts than the general population.

“The privileged access that technical personnel have to an organisation’s infrastructure can lead to them being actively targeted by adversaries, so advanced or even average susceptibility to phishing is a concern,” Connor explained. “Post-study surveys found that these personnel were more aware of previous phishing attempts than others, so we know this is a real threat. The fact that they click as often or more often than others, even with their level of awareness, highlights a significant challenge in the fight against phishing.”

Out of the two organisations studied with personnel working in IT or DevOps, both clicked test emails at rates that were either equal to or higher than other departments in their organisations: 26% from DevOps and 24% from IT compared to 25% for one organisation and 30% from DevOps and 21% from IT compared to 11% for the other organisation.

Furthermore, the study found that these departments were no better at reporting phishing attempts than others. In one organisation, IT and DevOps came third and sixth out of nine departments in terms of reporting. In the other organisation, DevOps was the twelfth best at reporting out of 17 departments, while IT was fifteenth.

The value of a fast, easy-to-use reporting process was also highlighted in the report. In the first minute after the test emails arrived in inboxes, over three times the number of people who reported it as suspicious had clicked. This number levelled out at around five minutes and stayed consistent after that.

And while reporting became more common as time went on, the different processes at different organisations played a key role. 47% of participants from an organisation that provided all employees with a dedicated button to flag suspicious emails used it during the study. Only 13% and 12% of participants from two other organisations reported their test emails (the remaining organisation did not provide data on reporting).


Riaan Naude.

According to F-Secure director of consulting, Riaan Naude, the patterns in report and click rates identified by the study highlights a practical opportunity for organisations to mobilise employees in a collective effort to protect themselves against phishing.

“The evidence in the study clearly points to fast, painless reporting processes as common ground where security personnel and other teams can work together to improve an organisation’s resilience against phishing. Getting this right means that an attack can be detected and prevented earlier, as security teams may only have a few precious minutes to mitigate a potential compromise,” said Naude.

Read the full report at https://www.f-secure.com/content/dam/press/en/media-library/reports/to-click-or-not-to-click.pdf




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Pentagon appointed as Milestone distributor
Elvey Security Technologies News & Events Surveillance
Milestone Systems appointed Pentagon Distribution (an Elvey Group company within the Hudaco Group of Companies) as a distributor. XProtect’s open architecture means no lock-in and the ability to customise the connected video solution that will accomplish the job.

Read more...
SMART Estate Security returns to KZN
Nemtek Electric Fencing Products Technews Publishing Axis Communications SA OneSpace Editor's Choice News & Events Integrated Solutions IoT & Automation
The second SMART Estate Security Conference of 2024 was held in May in KwaZulu-Natal at the Mount Edgecombe Estate Conference Centre, which is located on the Estate’s pristine golf course.

Read more...
From the editor's desk: Just gooi a cable
Technews Publishing News & Events
      Welcome to the 2024 edition of the SMART Estate Security Handbook. We focus on a host of topics, and this year’s issue also has a larger-than-normal Product Showcase section. Perhaps the vendors are ...

Read more...
Secutel wins OSPA Award for Outstanding New Security Product
Secutel Technologies News & Events Access Control & Identity Management
[Sponsored] Secutel Technologies’ NoKey Access Control solution won the Outstanding New Security Product category at the 2024 OSPAs in South Africa. The awards were presented at Securex 2024 where all category finalists were recognised for their contribution to the security industry.

Read more...
ONVIF launches new working groups for cloud, metadata and audio
News & Events Surveillance
ONVIF, the global standardisation initiative for IP-based physical security products, is announcing the formation of three new working groups to tackle standardisation work in cloud connectivity, audio, and advanced metadata.

Read more...
Inaugural Gallagher Security Johannesburg networking roadshow
Gallagher News & Events
Held at Johannesburg’s Foghound Coffee Company in Midrand from 11 to 12 June, security industry professionals gather at the inaugural Gallagher Security Johannesburg Networking Roadshow.

Read more...
Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Read more...
Dallmeier receives ISO 27001 certification
Dallmeier Electronic Southern Africa Surveillance News & Events
Dallmeier has received ISO 27001 certification for its Information Security Management System (ISMS). The international standard for information security management ensures that companies meet the highest standards of data protection and data security.

Read more...
Local manufacturing is still on the rise
Hissco Editor's Choice News & Events Security Services & Risk Management
HISSCO International, Africa's largest manufacturer of security X-ray products, has recently secured a multi-continental contract to supply over 55 baggage X-ray screening systems in 10 countries.

Read more...
SAIDSA achieves ISO 9001 certification
SAIDSA(SA Intruder Detection Services Association) Associations News & Events Training & Education
The South African Intruder Detection Services Association (SAIDSA) has announced that it has achieved ISO 9001:2015 certification. This milestone reflects its commitment to quality management and excellence in the security services industry.

Read more...