Security awareness training and phishing simulation

Security awareness training and phishing simulation is the program through which a company teaches its staff to recognize a fraudulent email or call, then measures the result by sending them fake lure messages. The case that moved the question dates from September 2023. At MGM Resorts, according to the attackers' account picked up by the press, the intrusion started with a call to the IT help desk, where someone posed as an employee to get access reset. Nobody had clicked on anything. Since then, the more thorough applications ask whether the help desk verifies a caller's identity before resetting a password or a multi-factor authentication (MFA) factor, and help desk training has become a line of its own. The classic question is simpler: training at least once a year, regular simulations, tracking of click rate and report rate. The underwriter sees none of this from outside. He asks for the latest campaign, its click rate, and what happens to the employee who clicks three times. Report rate often says more than click rate: a workforce that reports fast shortens the gap between the first click and the security team's response. On the policy side, awareness mostly bears on social engineering fraud, the wire sent on the strength of a fake email from the CEO or a supplier. Many policies cover it under a sublimit, sometimes on condition of a callback before any change of bank details. A practitioner's caveat: a 2% click rate on easy templates proves little, and simulation vendors let the client pick the difficulty. A low number can reflect a soft test as much as an alert staff.