Phishing email training can significantly reduce the susceptibility of the workforce to phishing attacks, yet some employers fail to train their employees how to recognize phishing attempts or do not invest sufficient time and resources in improving the security awareness of the workforce. If phishing and security awareness training for employees is viewed as a checkbox item for compliance, the training is unlikely to be very effective at reducing risk.
Training the workforce does come at a cost. There is the cost of purchasing the training material, but also a time cost. When employees are being trained, they are not working. A business with 1,000 employees that provides training that lasts 3 hours a year, will suffer a 3,000-hour productivity loss each year. It is also important when committing so much money to training that the training is effective at reducing risk. It should be noted that while the cost of training can be considerable, it is far lower than the cost of resolving a cyberattack and data breach, which the 2022 IBM Security Cost of a Data Breach Report shows has risen to $4.24 million.
Phishing Email Training Significantly Improves Security Posture
Phishing training for employees can make a huge difference. According to the KnowBe4 Phishing by Industry Benchmarking Report, which explored the effect of phishing email training at more than 30,000 organizations across 19 industry sectors, phishing email training reduces click rates in phishing email simulations by an average of 85% after a year. Before training, 32.4% of employees failed phishing tests. 90 days after the start of training the percentage fell to an average of 17.6% of employees failing phishing tests, and just 5% after a year.
To achieve results like that, phishing email training needs to be conducted correctly. To help get you on the right track, we have listed some of the most common mistakes companies make when providing phishing training, which reduce the effectiveness of training and stops them from getting a decent return on the investment of time and resources.
Common Phishing Email Training Mistakes to Avoid
The goal of phishing training is not to stop employees from ever clicking on a link in a phishing email or opening a malicious email attachment, as employees are human and will make mistakes. The goal is to develop a security culture where every employee is aware of cyber threats they may encounter, to teach them to always think about security, and not to engage in risky behaviors. To achieve that goal and create a security culture in your organization, these are the mistakes that need to be avoided.
Failure to Make Training Engaging and Fun
Phishing email training may not seem like much fun to a lot of employees, but that does not mean that training courses need to be boring. Create training content that engages employees, is interesting, fun, and even use humor. Cybersecurity is a serious topic but that does not mean that the training should not be enjoyable. If employees are engaged and the content is gamified, knowledge retention is likely to be much better. Consider using a phishing email training course developed by a cybersecurity company or training vendor, as it is much easier than creating fun training content from scratch.
Failing to Tailor Training to Individuals and Roles
One of the biggest mistakes is developing or using a single training course for the entire company. Phishing emails that target the CEO and other board members are different from those that target the HR and finance departments. Training needs to be tailored to user groups and should cover the phishing threats each is likely to encounter. Modular training courses make it easy to tailor training down to the individual user level. Also, vary the materials used in training as you need to make the training course interesting for a wide range of employees.
Failure to Address All Types of Phishing
Phishing email training will help employees to recognize malicious emails, but phishing is not just conducted via email. It is increasingly common for campaigns to be conducted on social media networks, via SMS and instant messaging services, and also over the telephone. You should ensure your training course covers all these attack vectors and includes relevant examples of each type of attack.
Failing to Update the Training Course
In order to remain relevant, the training course will need to be updated. You should keep abreast of the latest phishing tactics and ensure they are incorporated into your training course. The easiest way to do this is to use a cybersecurity vendor’s training course – one that is regularly updated to include the latest phishing tactics.
Failure to Conduct Continuous Training
Training should be provided when new employees join the company and regular refresher training courses conducted at least annually, but ideally, biannually or quarterly. Regular security reminders should be issued, and additional training should be provided on new phishing threats. Through continuous training, organizations can develop a security culture. That will not be possible with a once-a-year training session.
Failure to Conduct Phishing Simulations
After each training course, quizzes should be used to test whether the training course has been understood, but it shouldn’t stop there. Phishing simulations should be conducted on the workforce regularly to test whether the training is being applied. If an employee fails a phishing simulation, it should trigger additional training to correct the risky behavior.
