Alt text: Michael Scott Handshake meme. Managers text: “My company Congratulating me on avoiding a phishing test email”. Michael Scott text: “Me, terminally behind on answering email.”
Alt text: Michael Scott Handshake meme. Managers text: “My company Congratulating me on avoiding a phishing test email”. Michael Scott text: “Me, terminally behind on answering email.”
I see the benefit of reporting to catch false negatives of the filters, but in reality, if I received more than one report in a week or two, id consider a new system for scanning. A 20% false negative rate is pretty bad. Most emails should be easily identified, and I think it’s unreasonable for end users to check if the sender domain name is newly registered, has utf-8 characters which look like ASCII characters, etc. The metric for success shouldn’t be a high number of end users reporting phishing emails, but that seems to be what upper management wants to see, which just incentives less resources invested in better scanners with less than a 20% false negative rate.
The eternal battle between the “oh we go by data backed metrics, much measured, I feel this is the best” executive suite and the poor saps beneath twirling the data backed signs going ignored until money or disaster strikes.
Pity businesses aren’t formed from the bottom up; it’s like an octopus deciding not to listen to its arm brains until the shark has a bite of its head.