"Phishing Defense, One Simulated Email at a Time"

San Francisco uses an automated solution to train its 30,000 employees to recognize and report phishing attacks. According to Michael Makstman, the city and county's CISO, all employees receive at least one simulation per month. If the platform detects that the user fell for the simulation, it automatically sends more simulated emails to that individual. When an employee clicks the link in the training email, a webpage containing a training video on how to avoid falling victim to phishing attempts in the future opens. Since 2020, San Francisco has been using the CybeReady solution. In the first 18 months, the simulations' click rate decreased by 50 percent, according to Makstman. CybeReady updates the simulations as the fraudsters' methods evolve. For example, they may invite employees to click a Zoom link to attend a meeting, even if the department typically uses Microsoft Teams. The platform prepares ten simulations every quarter, but not all employees receive the same one. High-risk employees receive extra training on top of the phishing simulations from CybeReady. This article continues to discuss the structure, goals, and results of the automated platform San Francisco uses to train its employees to avoid phishing attacks. 

GCN reports "Phishing Defense, One Simulated Email at a Time"