Where a phishing test goes wrong

There’s a phine line between an effective phishing test and one that gets everybody so worked up that they side with threat actors for an afternoon.

Some phishing tests have gone way wrong in highly publicized ways over the years, including fake offers of holiday bonuses during a pandemic, “emergency notifications” of a disease outbreak, and, most recently, NBA championship rings for Madison Square Garden employees.

Testing workers’ awareness of the latest phishing strategies remains an essential part of a company’s security program. But there are counterproductive consequences when an IT pro plays with a recipient’s emotions and sends a tone-deaf test.

“You can harbor resentment within an organization if you do it poorly, and that’s absolutely not what you want,” Erich Kron, CISO advisor at cybersecurity company KnowBe4, told us.

We spoke with IT pros about how to test employees’ phishing knowledge without testing their patience.

The test is still on. Verizon’s 2026 Data Breach Investigations Report found that email is still a top attack vector, factoring into 98% of studied social-engineering breaches.

While the IT pros who spoke with IT Brew still believe the phishing test has an important role in company cyber strategies, they also noted the importance of empathy in any assessment.

Kron told us that an ineffective phishing test is designed to trick people and drive up click rates rather than reinforce training. Problematic pieces of an email may include sensitive or poorly timed themes—such as termination, salary, or bonuses after layoffs—which can create resentment and make employees less willing to report real threats.

“The mindset should be to help reinforce training that you gave, much like a lab in a college class,” Kron said.

The tests should be a way for employees to practice reporting, Kron told us. If an IT team notices extremely high click rates, they should communicate clearly and quickly what’s going on (a simulated attack, let’s say) and why.

All in! Andrew Amaro, founder and “in-office hacker” at cybersecurity company Klavan Security, sees phishing tests as just one part of a workplace cybersecurity strategy that should also include group-centric ideas like lunch and learns, tabletop exercises, and security newsletters. Failing a phishing test becomes less embarrassing if it’s not the only thing you’ve participated in, he said.

When everyone’s involved, the organization can also address risks more holistically, without individuals feeling embarrassed by people they don’t really know.

“Everybody, regardless of what their role is, if they’re in IT, HR, marketing, executive: everybody has a role in our cybersecurity function in the company,” he said, “If we all talk together, we can look at what threats and risks we can tackle together.”

Check your work. Phishers change their tactics as savvy employees catch on. AI has given threat actors new abilities to craft convincing attacks at speed. Lately, email adversaries have sent effective and malicious calendar invites.

Those are the kinds of emails Ant Davis, academy and community lead at cybersecurity company Hoxhunt, would suggest sending now, as he sees effective phishing tests reflecting present-day tactics: “Anything that’s surging, anything people are talking about, I want to add it into my portfolio. I want to be simulating that, so people understand it and talk about it.”

Davis warned, though, that phishing tests go wrong when they undermine psychological trust and safety for the recipients who click on them too often. Companies should be considerate of their business environment and its hot-button issues, he advised, along with any actions that appear to punish or name an individual.

Like most writing, it helps to have an editor—and HR can be a great resource on what might or might not go over well with employees, Kron told us. In this context, a fake phisher on the IT team needs to follow the advice they preach: be careful and get a second look.

“I truly believe that you should have somebody double-check this, especially if it’s something that’s even remotely sensitive,” Kron said.