FOR INTERNAL DISTRIBUTION ONLY. PLEASE DO NOT FORWARD, PRINT, OR REPLY ALL.

The Information Security Awareness Enablement Team is pleased to share the results of this year’s simulated phishing exercise, which concluded on Friday and which 94 per cent of colleagues failed.

Key findings

The exercise email was sent at 9.12am on a Tuesday to 3,214 colleagues under the subject line “Action required: parcel held at depot, plus your bonus”. The Team had deliberately written it to be implausible. Some 3,021 colleagues clicked the link, 412 of them inside the first minute, and 38 forwarded it to their teams with the comment “worth a look”.

In the same week, People Services issued a genuine communication titled “Exciting changes to your benefits”. It was reported to Security as suspicious by 100 per cent of recipients, including its author, who reported it from her own sent items and asked whether she should be worried.

“It knew my name, my cost centre and that I was expecting a parcel. The last thing HR sent me began ‘Dear Colleague’ and was about someone who left in 2019. Only one of those emails felt like it came from people who knew me.” Priya Nair, Senior Procurement Analyst

The Team notes that the benefits email contained no links, no attachments and no requests for information, which several respondents cited as the main reason for their concern. Others pointed to the word “exciting”, which 1,140 colleagues described in their reports as “not something that has ever preceded good news”.

Management response

Gillian Pratt, Head of Security, said: “We have taken a number of learnings from this exercise, and we expect to take a number more from the learnings themselves. It is too early to say what they are. I would like to thank everyone who clicked, and also the 6 per cent who did not, whom I would like to speak to.”

Daniel Whitcombe, Head of People Experience, said: “Our benefits communication was reported 3,214 times, with a further 61 duplicate reports from colleagues who wanted to be certain. We are choosing to regard this as engagement. The changes themselves remain exciting, and we will not be taking questions on them.”

Next steps

All colleagues who failed the exercise will be enrolled in a mandatory 45-minute module titled “Spotting the Signs”. Colleagues will receive the module by email, from an unfamiliar sender, with an urgent subject line and a link. This is how the module is delivered. The Team asks colleagues not to report it, as the Team has already received 400 reports about it and is unable to reply to them all.

As a reminder, colleagues should always hover over a link before clicking it. Hovering means resting the cursor on the link without pressing anything. During the exercise, 211 colleagues attempted to hover by clicking firmly and then reading the address afterwards. The Team recognises this as a valid instinct, and it will be addressed in the module.

The Team would also like to clarify that the exercise was not a judgement on anyone’s character, and that the spreadsheet of results, sorted by department and by speed of clicking, is a working document and not a league table. It has been shared with all Directors.

Further information

Further information is available at this link. Colleagues should not click it, for reasons nobody can now establish. The instruction was added by a previous iteration of the Team and the reasoning was not recorded. The Team has reviewed the matter and decided to leave it in.