How we test
The phishing campaign measured how employees in the target group respond to realistic phishing emails. The target group and campaign details are listed under Scope & dates, and the campaign results are shown in the phishing statistics at the top of the executive summary.
The campaign was agreed with the client in advance, including the target group, the email scenarios, the sending period and how reported emails would be handled.
Approach
- Preparation: design of email scenarios and landing pages that resemble real-world phishing attacks relevant to the organisation, and setup of the sending infrastructure.
- Delivery: emails were sent to the target group during the agreed period.
- Measurement: the campaign recorded which emails were opened, which links were clicked, where credentials were submitted on the landing page, and which emails were reported by users.
- Reporting: results are given as numbers and percentages of emails sent, together with findings on technical controls (such as email filtering and sender authentication) and recommendations for awareness training.
Data handling
- Submitted credentials were not stored or used. Only the fact that a submission took place was recorded.
- Results are reported for the group as a whole, not for named individuals.
Limitations
- Open rates depend on email clients loading images and may be lower than the real number of emails opened.
- Results reflect the scenarios and period used. A different scenario or timing could give different results.
- Email filtering may have blocked some emails, which can lower the measured rates.