Phishing training prizes

Posted by Det_23324@reddit | sysadmin | View on Reddit | 13 comments

Hi all, We're looking into giving out prizes for users who successfully report phishing messages... We're going to base it on number of submissions and how good the submissions are. I was wondering how everyone else has implemented this? The big thing I'm worried about is people reporting tons and tons of emails (mostly spam) and then just bombarding us with emails. I'm hoping to avoid that and wanted to see if there's a good way of rolling this out without the mass spam. If thats not possible than I guess I'll just have to accept that.

Reply to Post

13 Comments

[-]

bjc1960@reddit

I won a pair of socks that I would have never been caught dead wearing. At my current company, we are small and give away Starbuck's cards we get from our Credit Card company

[-]

Superspyi@reddit

We just very recently "gamified" our phishing email campaigns. Basically we have a campaign every single month. The campaigns contain random emails to random users at random times throughout the weeks the campaign is active. As long as the users do not do anything that would make them fail within KnowBe4 then they get entered into a drawing at the beginning of the next month for a $25 gift card.

[-]

zrad603@reddit

Literally saw this meme a few minutes ago: https://preview.redd.it/jewfloppgx4b1.png?width=720&format=png&auto=webp&v=enabled&s=e36730b5396ad2141e3d83dd40141cad3812c839

[-]

Superspyi@reddit

I work for an electric utility so that’s basically how our linemen do it lmao.

[-]

ughisthisnametaken@reddit

This is a great idea! Positive reinforcement is the best way to train. I'm one of the people that creates and sends phishing emails and it's disparaging when our customers punish those who click. Reward those who report before clicking but especially award those who report AFTER clicking or entering creds. The best defense is for the users to trust IT and be able to come to them after they screw up without fear of reprisal.

[-]

Det_23324@reddit (OP)

That is definitely true. Thanks for the input

[-]

ahazuarus@reddit

We use proofpoint phishalarm analyzer. it comes back with different categories, I would simply exclude spam altogether and reward a user based on submissions of all non-spam potentially unsafe reports. However, bear in mind users who have been with the company longer will have a larger pool of inbound to report from so maybe a tangible reward isn't the best approach.

[-]

thecravenone@reddit

Not an answer but keep in mind that if the prize has value, you'll need to talk to HR/payroll about taxing it and some people may not be happy about that. I've seen Starbucks and Chili's gift cards cause annoyance because the user would rather have that dollar or whatever of cash that was taken off their check than a gift card they're unlikely to use.

[-]

Det_23324@reddit (OP)

Makes sense. Our plan is to only give out gift cards. More than likely they will be amazon and I think everyone uses Amazon.

[-]

mrbiggbrain@reddit

We printed out "Golden Tickets" that we awarded at big company events such as quarterly meetings or yearly gatherings. "This Golden Ticket entitles the owner to turn it in for one immediate escalation of any IT issues or ticket, subject to other high profile outages." Two fold. User gets a really nice way to skip the line when something is important (And boy did people hoard them) and you get to fund out the things that are actually important. Someone turning in a golden ticket speaks volumes on the day to day things that make their job run and their life harder or easier.

[-]

Det_23324@reddit (OP)

I like that idea. A good benefit plus it doesn't cost anything.

[-]

sirpoopshispants@reddit

I would personally do it silently rather than announcing it. When a user reports a phishing message just have something pre-typed up "Because of your quick submission, we were able to withdraw the email from 25 peoples mailboxes". Word will spread and they will realize that reporting PHISHING emails will get you rewarded. For spam ones, just follow up with users how you normally would and don't mention anything about the prize unless they ask. If you wanted to make an announcement, it could be security focused such as "With the increase in phishing emails, IT will be giving out rewards to users who report any emails which are attempting to gain your username or passwords. Please note that regular spam emails are different than phishing emails." Also, I would inform HR about what your plans are to get ahead of anyone complaining that "Susan got a reward but I didn't and I feel it's because I'm (insert protected characteristic here)."

[-]

Det_23324@reddit (OP)

That makes a lot of sense. Thanks for the tip. I definitely will involve other departments to make sure they are aware.