Earlier this month I wrote that phishing is an industry and that click rate is a vanity metric. Then the Knicks showed us what a phishing test built around the click looks like.
In late September, Madison Square Garden emailed a long list of employees: “(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you.” It was a phishing test, and according to The Athletic (paywalled, quoted by Ars Technica), employees who clicked “were forced to attend a mandatory cybersecurity class.”
The offer wasn’t far-fetched. Per The Athletic, most NBA team employees get some kind of ring. Then on ring night (Oct 20) the assistant coaches were handed empty boxes, and The Athletic’s sources reported that many longtime MSG employees wouldn’t get rings at all.
In fairness to MSG, its statement (also via Ars) says the company “was recently hacked and extorted using an employee login and password obtained through a similar phishing attack,” and calls the ring lure “an unfortunate mistake.” It also says it’s gifting more than 275 rings and jewelry, worth over $3.7 million. The worry behind the test was real… I just think the test made things worse.
Concern #1: You taught people that the email they want is a trap
The lure used the one thing employees had good reason to believe. What a lot of people will take from that is that security will use whatever they care about against them. The UK’s NCSC says phishing simulations “erode trust between employees and security,” and that punishing people for clicking emails you sent “starts to resemble entrapment.” They recommend checking with HR before running one.
Concern #2: Embarrassment kills reporting
Reports are how you find out about the phish your filters missed. NCSC again, from a blog post: “the stigma of clicking can prevent people reporting it, which then delays the incident response.” The next real phish is the one you need people to report, especially the ones who clicked. A mandatory class with your name on the list doesn’t make that call easier.
Concern #3: The class may not even help
An ETH Zurich study ran simulated phishing at a company with 14,000+ employees for 15 months. People shown training after falling for a simulation clicked more often afterward than people who weren’t shown it. That training was a voluntary page rather than a mandatory class, so it’s not a perfect match. The same study found the report button held up: employees kept reporting over the long haul and new campaigns got spotted fast.
Perhaps a better framing:
A phishing test should leave people more willing to report. If it makes your staff trust security less, it failed, whatever the click rate says.
What I’d do instead:
- Run lures past HR and comms. No fake bonuses, raises, benefits, PTO, or gifts the company could actually give.
- Score reporting. Track report rate and time-to-report, and thank people quickly… including the ones who clicked first.
- When someone clicks, a short note in the moment is plenty. Save the mandatory stuff for real patterns, and ask why before you assign it.
- Fix what the test is standing in for. By MSG’s own account, a phished login and password got someone in. Where does a password alone still work at your shop? (Same question as last time.)
If your phishing test makes people trust you less, you just ran the attacker’s play for them.
