The phishing test everyone fails

New employees often encounter a fake phishing email during onboarding that tells them they failed a security test. The lesson is to be more careful next time, but real scams are harder to spot.

The awareness gap that isn't

A survey of one thousand eight hundred ninety technology and security professionals found eighty two percent had received employer security training.

Yubico and Okta's finding

Yubico, which sells hardware security keys, and Okta, which provides identity management services, conducted the survey July two through sixteen across nine countries. Results released October seven show the real problem is adoption, not awareness.

“The gap was not the awareness; it was the adoption.”

Why training isn't enough

Lorrie Faith Cranor, director of Carnegie Mellon University's CyLab, says knowing the rules doesn't mean catching every suspicious request.A scam works because it addresses a real need like finding a job or pleasing the boss.

The new employee trap

In November twenty twenty five, someone described buying eight hundred dollars in Target gift cards on their second day at a new job after receiving an email impersonating their boss.

AI makes phishing harder to spot

Over half of survey respondents reported being directly targeted by personalized phishing attacks. Forty four percent said their organization experienced at least one successful AI-driven phishing attack in the previous year.

When humans and AI look the same

Respondents were shown two versions of an HR email, one written by a person and one by AI. Only thirty six percent correctly identified the human-written message, while fifty four percent thought AI wrote it.

“Sure, there are still some simple phishing messages that you might spot by looking at typos, but a lot of phishing messages are written by AI agents with perfect grammar and spelling and they mimic corporate style and branding.”

MFA has limits too

Cranor said multifactor authentication provides substantial protection, but its forms differ.Text-message codes can be vulnerable when an attacker persuades a mobile carrier to transfer a victim's number.Even authenticator apps can be undermined by deception.

“So it is important to never give anyone these codes.”

What actually works

Training should teach concrete skills and give people practice using them, Cranor said.Employers should also make checking a request part of the job.