Simulated Phishing Attack and Staff Awareness Training Programme

Identify and understand your staff’s awareness of phishing

Phishing attacks are quick and easy to implement and deliver an enormous return on investment, which has motivated criminals to create increasingly sophisticated and creative phishing ‘lures’.

These are often indistinguishable from genuine emails, text messages or phone calls; in general, affected users don’t report the compromise until it is too late, inflicting enormous damage on your organisation. Senior management need regular assurance that staff have been properly trained on how to spot phishing emails, and the only real way to achieve this is through a simulated phishing attack.

This service is entirely bespoke and will be crafted according to your needs. A typical engagement will comprise the following stages:

1. Perform the phishing campaign
1. Work with our consultant to identify the best type of attack to target your staff with, who you’d like to target and the key metrics you want to track.
2. Once we understand your requirements, we will design and build the bespoke attack, which involves setting up a domain, creating an email template to mimic your own, building web pages, etc.
3. We will compile the results of the test into a comprehensive report that highlights any weaknesses within your business.
2. Perform staff training
1. Our interactive e-learning course helps employees identify and understand phishing scams, explains what could happen should they fall victim, and shows them how they can mitigate the threat of an attack.

Our phishing campaign will be performed before and after training to track improvement.

At the end of the campaign, you will receive a comprehensive report broken down into:

 Download the full service description

Methodology

This test will be performed using IT Governance’s proprietary security testing methodology, which is closely aligned with the SANS, OSSTMM (Open Source Security Testing Methodology Manual) and OWASP (Open Web Application Security Project) methodologies.

How this programme will help you

• Quickly find out if there is an internal phishing awareness problem.
• Determine which employees require additional phishing training – an effective way to change end-user behaviour.
• Craft campaigns based on the experiences and threat analysis of our expert security testing team.

Who is this service for?

This service is suitable for organisations that want to understand their staff’s awareness levels or test the effectiveness of their phishing training.