Beyond Detection: Using Real Phishing Data to Gauge Security Training Program Success

Identification of phishing emails can be cumbersome, accomplished by rule-based filters, machine learning, user-submitted, and other automated analyses. User submission is the cheapest and easiest to implement but a much more time-intensive process, adding overhead to already burdened staff.

Analysts digging through these reported emails are likely overwhelmed with ticket work, often leading to missed opportunities to find a malicious email and remediate the email’s threat before any user replies, clicks on URLs, and submits credentials. Usually, the only course of action is scheduled or remedial user awareness training. By searching for malicious indicators in phishing emails, these metrics can be built based on phishing tactics seen in organizations.

This paper defines one method of network security monitoring in an organization to find these existing indicators. It covers the tools utilized, assuming organizational prerequisites are met to analyze decrypted packet captures with network security monitoring.