I think fake phishing messages over the same channel real ones would be in are the way to go.
yes you are totally right that actually getting a phishing message is very different than a learning enviroment, but also we have seen that people don't have the tools to undestand what should raise suspicious (domains, wording, tactics, etc) and that's super dependant of context! For example I'm from Argentina, a phishing case targeting elders in my city might be very different than the ones targeting an investigative journalist (to try to get their info) or a business (to try to get access to their systems). And targeted phishing cases are much easier to create nowadays with ai and all the information avaible online about ourselves, our companies, etc!
Research (and our experience) has shown that the phising simulation (the "fake phising" you describe) is not as effective: https://shira.app/phishing-quizzes
So basically our appoaach was to create the plaforms so that trainers and educators (with our guidance) could create learning experice could create a learning enviroment tailored to the apps, level, context, language of the particular group they are working with.
We launched the platform with a beta program and we received very possitive feedback on learners actually changing behaviour: https://blog.wearehorizontal.org/introducing-shira-2-0-end-t...
We are trying to get even more feedback from the communtity happy to hear if this makes sense to you or any other ideas or comments !! thanks so much for commenting :)
would love to get your feedback on it :)
We are also aunching a free-program for 10 orgs on our Enterprise plan --> https://docs.google.com/forms/d/e/1FAIpQLSc5nl1K8IQWuvoR_6PH...
[dead]
We (and reseach) have found that the "phishing simulation" technique has not been effective. This "IT/Security sending a phishing-email" that you describe is the standard in the industry but it does not foster a space where real education and undestanding about what should be consider suspicious (and why) can occur. We have seen people alerting each other on private channels "be careful with this email, that's the phishing, simulation!". So IT have false data and people are not actually learning much...
Shira allows creating a controlled learning enviroment where people can learn about the phishing tactics and how to detect those in a controlled setting, with tailored explanations adapted to the org language/level/context :)
We wrote about it here: https://shira.app/phishing-quizzes
We launched it with a beta program some months and we have had very good feedback on effectiveness so far!
This is a demo quiz que created, but the idea is that trainers can create their own quizzes with any content and explanations they want https://quiz.shira.app/