Comment Was it a fair test? (Score 1) 40
Tests like these shouldn't be a "gotcha." They should be fair.
* Had employees already been through some basic anti-phishing training?
* Did the test include something that someone who paid attention during the training course would be reasonably expected to spot?
There is one other use for tests like these: To survey the population of employees: What % of employees clicked on the link, and what do we need to do organizationally (not "just for those who failed") to lower this number to something we can live with?
But it shouldn't be a "gotcha."