A phishing test is a fake attack you run on your own people, on purpose. A message that looks like the real thing lands in their inbox, and the only thing at stake is a lesson. Here is what the emails in a good test look like, because they are not the obvious ones.
The IT notice. "Your password expires today. Sign in to keep your mailbox." The sign-in page is a copy. This is the one most people fall for, because it looks like something we might send.
The invoice. "Attached is the invoice we discussed." From a vendor's name, with a file or a link. Accounting opens it because opening invoices is the job.
The shared file. "Jane shared a document with you." The name is real, lifted from the company's own website or LinkedIn. The link asks you to sign in to see the file.
The boss in a hurry. "I'm in a meeting, can you pick up some gift cards and send me the codes." Sometimes an email, often a text. It works on the newest person in the office.
The delivery. "Your package could not be delivered. Confirm your address." Nobody at work was expecting a package, and the click happens anyway.
What makes the test fair is what happens next. Someone who clicks sees a short page that says this was a test, shows the two things that gave it away, and takes a minute. No name goes on a list in a meeting. The people who report the message instead of clicking hear that they did the right thing. Then it runs again next quarter, with a different message, because one test teaches nothing and a year of them changes habits.
Two numbers tell you whether it is working. The share of people who click, which should fall over a year, and the share who report the message, which should rise. The second one matters more. A company where people report a strange email within minutes is a company where the real one gets caught.
For our clients, the test is part of the plan. Short, regular training and a phishing test every quarter, run by us, with the results read to you in plain words. If you want a head start on the tells, nine signs an email is a phish is the list. And if you would like to see what your own people would click on, that is a thirty-minute conversation.
Questions people ask
Plain answers.
What is a phishing test?
A fake phishing email sent to your own people on purpose, so the ones who click learn from it before a real one arrives. Nothing is at stake but the lesson.
How often should a business run a phishing test?
Every quarter, with a different message each time. A single test shows where you stand; a year of them changes habits.
What happens when someone clicks in a phishing test?
A short page tells them it was a test and shows what gave it away. Nobody is named or embarrassed, and the people who reported the message hear that they did the right thing.
Let's talk
Thirty minutes with a real person.
Tell us what's going on with your technology, what's working and what isn't. We'll listen, ask a few questions, and tell you honestly whether we're the right fit. No slides, no pitch. If we can help, we'll say how. If we can't, we'll point you to someone who can.
Reach out, any way you like. A real person takes it from there.
Based in downtown Winter Haven since 1996, with offices in Orlando, Tampa, St. Petersburg, and Miami, serving businesses across Florida.