Challenge accepted: How today’s security pros go spearphishing

So, you think you can spot a phishing test just by skimming that slightly suspicious subject line? IT pros like Andrew Amaro, founder and “in-office hacker” at cybersecurity company Klavan Security, are ready for ya.

Amaro has to deal with phish-ready employees all the time, including a client who once told him: “You’re not going to get us. We’re way too tech-savvy.”

The client’s confidence made Amaro embrace his inner Michael Jordan meme: “As a hacker at heart, I took it personally,” Amaro told IT Brew.

The client, he said, had an event involving an auction, food, and two artists working on a painting live. Amaro created a fake raffle for t-shirts featuring the art. The effort included a page of clothing designs with the company’s logos.

“Let’s just say a lot of people want t-shirts,” Amaro said of the test’s effectiveness.

But tricking employees with inventive ideas has consequences, and today’s IT pros face the challenge of testing their workplace without testing their patience. We spoke with IT pros about strategies for effective, creative assessments that prepare an organization for the targeted scamming known as spearphishing.

Promises, promises. Amaro is one of many IT pros who have gone through some intensive efforts to get employees to click faux-malicious links. Ant Davis, academy and community lead at cybersecurity company Hoxhunt, has created a fictional cider brand (and false offers of free tastings for anyone who clicks on an attached document and provides credentials). Davis once also created a bogus link promising employees photos of a company’s new building site.

David de Paula Santos Silva, founder and CEO of ethical hacking services provider CyberX, has simulated an invitation for a healthcare-focused online AI training course (with exclusive benefits for the first 100 people who place credentials in a designated portal!) to test a company’s phishing expertise. That attempt caught almost 15% of users at a healthcare institution, he told us.

Mimic the attacker. While these phishing tests are effective, one that’s poorly thought-out can have negative consequences on employee morale. For example, Martin Summerhayes, director of managed and technical services at managed services provider Northdoor, remembers once seeing an IT-led phishing email at a previous employer with an empty promise of cash prizes.

“There actually wasn’t a prize at the end of the day, which really created an awful lot of bad atmosphere, which wasn’t very helpful to the people that were involved,” he said.

Summerhayes, who is based in the UK, believes phishing tests should reflect attackers’ current social-engineering strategies, and that includes identity verification at credential-reset points such as the help desk, “because those are the most likely areas that you’re going to get potential threats.”

Attackers certainly see those credential-reset points as rich hunting grounds. Following a cyberattack on the London-based retailer Marks & Spencer, BleepingComputer reported that “threat actors impersonated one of the 50,000 people working with the company to trick a third-party entity into resetting an employee’s password.”

Are threat actors making t-shirts? But are today’s attackers really using bogus t-shirt contests and AI training courses? Verizon’s 2026 Data Breach Investigations Report (DBIR) revealed that threat actors are building trust—if not fictional cider brands—with their targets through a process known as pretexting. The DBIR defines the tactics as relationship building “through concocted scenarios to trick the user into taking an action that unknowingly compromises the organization, frequently by voice communications but also seen via email or text messaging.”

The DBIR saw pretexting—tracked specifically for the first time this year—as the initial threat vector in 6% of non-error breaches.

Meanwhile, a study from cybersecurity company KnowBe4, released on Oct. 29, revealed a 41% YOY increase in spearphishing, or highly targeted attacks.

“Attackers research their targets first, then craft a tailored message that appears to come from someone the recipient trusts,” the new report read.

Amaro said today’s very detailed spearphishers use publicly available information to make a message feel trustworthy and relevant. (New employees, he told us, are effective targets “because they have nothing to baseline.”)

“From an attacker’s perspective, data that seems pretty benign can be weaponized,” he said. “Expect that people are going to approach you, knowing certain pieces of information, and don’t automatically trust just because they know a piece of information that they can be trusted.”

In other words, it gets personal.