Staff at Dunmore Consolidated Packaging Solutions, a mid-sized firm in the East Midlands that makes cardboard for other people’s cardboard, achieved a 100 per cent pass rate in this quarter’s simulated phishing exercise, with all 412 employees declining to click a link in an email headed “Your Exceptional Performance Bonus: Action Required”.
The company announced the result in a staff-wide email on Tuesday, which fourteen people reported as suspicious.
Graham Pettifer, the firm’s IT security manager, had planned to present the figure at the next leadership meeting. “Last year our click rate was 23 per cent, and the year before that a man in Despatch entered his bank details into a form promising a free air fryer,” he said. “To get to zero in twelve months felt like the training was finally working.”
The first sign of trouble came when Pettifer reviewed the reports staff had submitted through the new “Report Phishing” button. Alongside the usual notes about spelling mistakes and unfamiliar sender addresses, he found a series of comments that were less technical in nature.
“It said bonus”
Most respondents had not examined the sender’s domain, hovered over the link, or noticed that the email addressed them as “Valued Colleague”. They had simply read the subject line and concluded that it could not be genuine.
“We haven’t had a rise since 2019, so we knew it wasn’t us,” said Denise Ormerod, a credit controller who has been with the firm for eleven years. “I didn’t even open it properly. I forwarded it to IT with the word ‘no’ and went back to my sandwich.”
Others were more specific. A warehouse supervisor wrote that the company had once described a pay freeze as “a shared journey”, and that he now assumed any message containing the word “reward” was either a scam or the opening act of a restructure. A member of the finance team reported the email on the grounds that the sum mentioned, £750, was “not a figure this company has ever said out loud”.
A separate test in March, offering staff a free team lunch, was reported by 97 per cent of recipients. The remaining three per cent were on leave.
“If the email had said we were being made redundant, I think about half of them would have clicked it, just to get it over with.”
That was Pettifer’s own assessment, delivered in the car park, and he was not smiling when he said it. He is understood to have run an informal second test, sending staff a message that read “Your hours are under review”. The click rate was 91 per cent, with several replies arriving in under a minute.
A strong result, on paper
Corinne Whitlock, the firm’s head of people and culture, has described the outcome as “a real testament to a vigilant, engaged workforce” and has asked for it to feature in the next employee newsletter, alongside a photograph of some cardboard.
“Our people are clearly switched on,” she said. “They treat every unexpected message with healthy suspicion, and I like to think that reflects the trust they place in us as an employer.”
Pettifer has the full set of reports saved in a folder on his desktop. He has considered forwarding them to Whitlock, and has drafted the email twice. On the second occasion he got as far as typing her name.
Instead, he has updated the slide to read “100% pass rate”, added a small green tick, and saved it to the shared drive. He has also renamed the folder “Misc”.
