San Francisco has enlisted an automated solution to train its 30,000 employees to recognize and report phishing attacks.
“Everybody gets at least one simulation a month,” said Michael Makstman, the city and county’s chief information security officer. “If the platform detects that the user fell for the simulation, it ups the training” by automatically sending more simulated emails to that person.
When an employee clicks the link in the training email, a webpage opens explaining that it was a simulated phishing attempt and providing a training video on how to avoid falling for such messages again.
“You have to simulate something real so that when the person gets into the situation, it becomes muscle memory,” Makstman said. “We need them to just pause and say, ‘Hey, let me let me double check….’ I tell my staff, ‘One person reporting can alert us to something major, and then we’re able to protect everybody.’”
San Francisco has been using the solution—from CybeReady—since 2020. In the first 18 months, Makstman said the click rate on the simulations fell by 50%.
CybeReady updates the simulations as scammers change their approach. For instance, they might invite employees to click a Zoom link to join a meeting when a department usually uses Microsoft Teams. That slight difference should be a red flag, Makstman said. Most recently, simulations have been around PayPal invoices, in line with a rising number of scams.
The goal is to make the training as real as possible so that hopefully when staff see something that’s not a simulation, they stop to think before clicking: “Why am I getting an invoice for $125?” Makstman said. “I don’t pay invoices…. Maybe I shouldn’t click on the link.”
The platform has a pool of 10 simulations that it prepares every quarter, but not all employees get the same one so they can’t tip one another off to the test. “We randomly send them throughout the month to different employees,” said Michal Gil, head of product development at CybeReady.
“We create a profile of the organization” based on the clicks, she said. The platform constantly monitors performance and divides employees into risk groups. It also uses advanced analytics to provide an in-depth analysis of the organization’s behavior that security managers can slice and dice based on their interest. With that data, “the security team has some insight into what’s happening in the organization,” she added.
CybeReady sends extra training on top of the phishing simulations to high-risk employees. Those who don’t fall for the phishing emails get some recognition. “Once every few months, we remind them, ‘Hey, you’re doing great. You’re not clicking phishing simulations. Here’s a quick reminder of the risks of cyberattacks,’” Gil said.
An approach that integrates training with daily workflow results in better learning, Gil said. “This is a new and innovative approach to the traditional training where everything’s mandatory and once a year you’d have to sit down [to] do this long training for an hour,” she said. “You can’t force employees to learn.”
San Francisco has long used email security tools, and it still requires employees to take regular trainings on other areas of cybersecurity. The platform “doesn’t obviate the need for training,” Makstman said. “It brings an experiential dimension to the training program.” His office has also stepped up annual training, security newsletters and tips.
The purpose is to increase awareness, not to call out individual employees, he said.
“We are actually doing a lot of business through email. Our residents email us and expect to be answered. We cannot shut [email] off. Links are meant to be clicked. The whole web is designed for links,” he said. “Penalizing staff or blaming our staff for doing things that they need to be doing, that the systems are designed to be doing, is not the right thing to do.… My goal is to empower our staff, but at the same time not to leave them alone in fighting all of this.”
In April, CybeReady announced a major enhancement to its Security Awareness Training SaaS platform called PhishCage. It provides a proactive response to phishing threats based on employee data using machine learning. It allows security officials to see where the biggest risks lie and to create custom reports, track metrics and make data-driven decisions.
Makstman said he’s also looking to incorporate simulation training for text messaging and phone calls.
“We want to get more and more data,” he added. “I have 50 agencies. We want them to have as timely insights into their workforce as possible.”
