By: Anders Bryde ThornildPhishing Training | 13 November
Share
Phishing Tricks
Which signs and methods fool people the most?
We use different "signs" in our phishing mails. One example could be Time Sensitivity - this is where there's a sense of urgency to click the link that pushes the user to click. We have 8 signs in total. Here's how they perform.
Time-sensitivity
Rewards
Curiosity
Context
Fear
Media
Trust/Authority
Do the right thing
Toggle to compare click vs. submit rates.
Best Time
People are most likely to click in lunch time
It turns out that the time of the day people are most likely to click and submit is doing lunch hour. Honestly, we don't know why. Maybe people are in a rush to get some food.
Lunch hour
19.2%
Click rate (12:00–13:00)
Lunch hour
11.6%
Submit rate (12:00–13:00)
CyberPilot | Click & Submit Rates by Weekday
By weekday
How do click & submit rates vary by weekday?
Alright, lunch is dangerous. But what about the weekdays? Is one day risiker than others?
Click rate
Data submit rate
Monday
Tuesday
Wednesday
Thursday
Friday
Early week is riskiest: Monday and Tuesday lead on clicks; Friday is slightly lower on clicks but relatively higher on submits.
Attack Type
Spear phishing vs automatic phishing
Here's how many people click and submit emails depending on what type of phishing email we send.
Spear phishing is targeted. Auto phishing is a more generic phishing mail.
Click rate
Spear phishing
Auto phishing
Submit rate
Spear phishing
Auto phishing
Employee Actions
What happens when a phishing email land in the inbox?
4 things can happen when you recieve phishing email. You can ignore it, you can report it, click it or even submit data. We can't track people who ignore it, but here's how people interact. Of course, we want reports to go up, which it does if you train.
Reported
5%
Reported the phishing emails
Clicked
9%
Average click rate from all phishing mails
Submitted
4%
Submitted data (tried to login on the landingpage after they clicked)
BY CAMPAIGN NUMBER
How do click & submit rates change over repeated simulations?
The most important thing about phishing training is that people become better at spotting
phishing emails. So do they? Our data suggest so. Of course it's a simplification as
difficulty in each simulation varies, but the trend is the same across all our customers.
Phishing training works:
Campaign performance
Showing click rate per campaign.
As employees see more campaigns, both click and submit rates trend down.
Phishing Training CTA
How would your company perform in a phishing test?
You’ve seen the numbers. Now you can try it yourself and see
how your employees react to realistic phishing attempts.
Sign up for our newsletterJoin our 2000+ subscribers and sign up for our newsletter.
You will receive inspiration, tools and stories about good cyber security practice directly in your inbox. Our newsletter is sent out approximately once a month.