‘The gap was not the awareness’: The company phishing trainings you loathe aren’t enough when nearly 1 in 4 security pros say their MFA is optional

A researcher browses an internet site with a job offer for a United Nations agency that has been flagged as a scam in Nairobi on June 30, 2022. A report by Code for Africa revealed that in 2020 when job losses soared during the Covid-19 pandemic 33 scam recruitment Facebook accounts, groups and pages with more than 184,000 followers targeted people in Kenya, requiring them to send about 350 Kenyan shillings ($3) before placements that never materialised. Syndicates behind these scams rely on the desperation of job seekers who fail to double-check the authenticity of job postings and send money without hesitation to secure employment, said Kenyan cyber security expert Anthony Muiyuro. (Credit: TONY KARUMBA/AFP via Getty Images)

Your first few weeks at work probably look something like this: figuring out who’s who on Slack, which floor has the best snacks, and navigating the hundreds of emails piling up in the inbox. Then one catches your eye. It says “Congratulations!” You click, and a new message appears: “You failed the test,” along with an attached invitation to security training.

Ladies and gentlemen, welcome to the decidedly forgettable experience of falling for a phishing scam—or in this case, the simulation of one. The lesson is to be more careful next time. But what happens when the next message looks like it came from the boss, lands during a busy afternoon, and asks for something that sounds perfectly reasonable?