Phishing training

Someone nearly paid a fake invoice, or a form wants proof your staff are trained. Security awareness training for a small business comes second. First, make every bank change wait for a phone call, and give people one way to report a suspicious email. Both are free and can start today. Then buy only what you need: CanIPhish’s free plan up to 10 people, or CyberHoot if someone wants a record.

Let the form decide whether you need simulations

Two published forms differ. Tokio Marine HCC wants “all employees” through training “that includes phishing simulations”. Chubb accepts “phishing simulations or other training”, yearly. Read yours, then read what else the renewal form asks. With no form and no client asking, simulations are optional: the FTC only says to “consider” them and the NCSC warns they can “erode trust”.

Buy by who’s asking, not by the size of the course library

Nobody asking for proof, 10 people or fewer: CanIPhish Free needs no card and includes the simulator. An insurer or client wants a record: CyberHoot, whose reports are made for them. Already on Microsoft 365 E5 or Defender for Office 365 Plan 2: use its Attack simulation training, which you’ve paid for, but don’t add Plan 2 just for this at $60 a person a year. There are sums for 5, 15 and 40 people and the reasons behind each pick.

Ignore click rates, and keep the proof

A falling click rate isn’t what stops the loss. In one large study, training after a simulation lowered later failures by about 1.7% in absolute terms. The call-back does more: the FBI’s advice on business email compromise is to “use secondary channels” to check requests to change account information. So don’t judge a service by its dashboard. Judge it by whether you can hand over the record the form wants. A fake invoice can also lean on your own name, which is what SPF, DKIM and DMARC are for.