27,000 employees tested for phishing
How defensible are companies when they are targeted by phishers? In 94% of the companies tested, at least one employee revealed his or her company login, as a phishing benchmark shows.
Tricking employees pays off for hackers. This is the conclusion of the second phishing benchmark of the Swiss consulting firm for information security Advact close. Phishing means that fraudsters attempt to obtain confidential information under a pretext. In September, the consulting firm took on the role of the attacker and wrote to the employees of 33 companies in six different industries. A total of 27,229 employees were invited by email to register with their company login on an unknown website.
In agreement with the participating companies, Advact recorded the employees' reactions and evaluated them anonymously. Respondents from all tested companies, a total of 17%, visited the deceptive website. 6% percent of those tested also entered their company login. However, the information provided was not submitted.
As a rule, the access data of a single employee is enough for a phisher to gain access to company data and systems. In 31 out of 33 companies, at least one employee was willing to disclose his or her company login.
Following the evaluation, all employees were informed about the phishing test, according to the media release. Through the experience and the education, the participants would learn to see through attack mechanisms more quickly and to react correctly in an emergency. Advact's phishing benchmark thus offers much more than just a comparison of companies.
Last year, 22 companies took part in the phishing benchmark. At that time, 33% of the people tested were successfully lured to a prepared website. 18% of all participants also entered a password, according to the report.
