{"id":6343,"date":"2026-10-09T07:11:35","date_gmt":"2026-10-09T07:11:35","guid":{"rendered":"https:\/\/www.vaultinsider.top\/?p=6343"},"modified":"2026-10-09T07:11:35","modified_gmt":"2026-10-09T07:11:35","slug":"the-gap-was-not-the-awareness-the-company-phishing-trainings-you-loathe-arent-enough-for-attacks","status":"publish","type":"post","link":"https:\/\/www.vaultinsider.top\/?p=6343","title":{"rendered":"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg?w=2048\" \/><\/p>\n<p>Your first few weeks at work probably look something like this: figuring out who\u2019s who on Slack, which floor has the best snacks, and navigating the hundreds of emails piling up in the inbox. Then one catches your eye. It says \u201cCongratulations!\u201d You click, and a new message appears: \u201cYou failed the test,\u201d along with an attached invitation to security training.<\/p>\n<div>\n<p class=\"wp-block-paragraph\">Ladies and gentlemen, welcome to the decidedly forgettable experience of falling for a phishing scam\u2014or in this case, the simulation of one. The lesson is to be more careful next time. But what happens when the next message looks like it came from the boss, lands during a busy afternoon, and asks for something that sounds perfectly reasonable?\u00a0<\/p>\n<p class=\"wp-block-paragraph\">A new survey from Yubico and Okta highlights why employers need an answer beyond another training session. Of 1,890 technology and security professionals, 82% had received employer security training. Still, 23% said their organizations did not require multifactor authentication (MFA)\u2014a login step beyond a password\u2014across all applications and services. Despite this, 88% described their enterprise as secure. For employers, the question is what stands between a convincing scam and a compromised account when a worker misses the warning signs.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe gap was not the awareness; it was the adoption,\u201d Poupak Modirassari Enbom, Yubico\u2019s chief market and growth officer, told <em>Fortune<\/em>.<\/p>\n<p class=\"wp-block-paragraph\">Talker Research conducted the survey July 2\u201316 across nine countries, polling professionals in technology and security roles at companies with at least 500 employees. The results, released Oct. 7, reflect that population, rather than workers generally. Yubico, which sells hardware security keys, and Okta, which provides identity management services, announced a partnership alongside the survey.<\/p>\n<p class=\"wp-block-paragraph\">Knowing the rules does not mean someone will catch every suspicious request, said Lorrie Faith Cranor, director of Carnegie Mellon University\u2019s CyLab, and a co-founder of Wombat Security Technologies, a security awareness training company later acquired by Proofpoint. A scam can work because it addresses a real need like finding a job, resolving an immigration concern, or pleasing the boss.<\/p>\n<p class=\"wp-block-paragraph\">\u201cBut if you get a lot of phish and some of them do address a need, even if you have reasonably good habits, you might let down your guard,\u201d Cranor told <em>Fortune<\/em>.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Hey, the boss needs a favor<\/strong><\/p>\n<p class=\"wp-block-paragraph\">In a November 2025 Reddit post, one person described buying $800 in Target gift cards on their second day at a new job after receiving an email impersonating their boss. The supposed assignment was to surprise office assistants.<\/p>\n<p class=\"wp-block-paragraph\">\u201cI\u2019m very new to the company, so I\u2019m still not entirely sure how things go there,\u201d the poster wrote. They said they recognized the scam before sharing the cards\u2019 redemption codes.<\/p>\n<p class=\"wp-block-paragraph\">Cranor said a person\u2019s risk depends on how often they are targeted, their security habits, their ability to recognize suspicious messages, and whether the lure really interests them. Even someone with good habits can simply be distracted, she added.<\/p>\n<p class=\"wp-block-paragraph\">Over half (55%) of respondents in the survey also reported being directly targeted by personalized phishing attacks. Another 44% said their organization had experienced at least one successful AI-driven phishing attack in the previous year.<\/p>\n<p class=\"wp-block-paragraph\">Some familiar warning signs are becoming less useful.<\/p>\n<p class=\"wp-block-paragraph\">\u201cSure, there are still some simple phishing messages that you might spot by looking at typos, but a lot of phishing messages are written by AI agents with perfect grammar and spelling and they mimic corporate style and branding,\u201d Cranor said.<\/p>\n<p class=\"wp-block-paragraph\">The survey put that to the test. Respondents were shown two versions of an HR email asking staff to sign off on an updated handbook, one written by a person and one by AI. Only 36% correctly identified the human-written message, while 54% thought AI wrote it.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Protection for the moment someone slips<\/strong><\/p>\n<p class=\"wp-block-paragraph\">The report recommends building stronger authentication into onboarding. Some 52% of respondents said they received username-and-password credentials when starting their roles, though that does not establish whether they also used multifactor authentication. Passkeys use cryptographic credentials tied to a legitimate site, so they won\u2019t authenticate a login on an imitation website. But that protection covers account access\u2014it won\u2019t stop someone from buying gift cards at a scammer\u2019s request.<\/p>\n<p class=\"wp-block-paragraph\">Cranor said MFA provides substantial protection, but its forms differ. Text-message codes can be vulnerable when an attacker persuades a mobile carrier to transfer a victim\u2019s number to the attacker\u2019s phone. Even an authenticator app can be undermined by deception. A scammer posing as a help-desk employee might ask someone to read out a code, then use it to access the account, she said.<\/p>\n<p class=\"wp-block-paragraph\">\u201cSo it is important to never give anyone these codes,\u201d Cranor said.<\/p>\n<p class=\"wp-block-paragraph\">And yes, training does still matter. Cranor said it can raise awareness that anyone is a potential victim.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">\u201cThis is a good start, but to be most effective, it also needs to teach concrete skills and give people practice in using them,\u201d she said. She added that training should also address the threats relevant to different jobs.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Employers should also make checking a request part of the job. If a message appears to come from the boss but something feels off, Cranor said, workers should verify it through another channel before responding.<\/p>\n<p class=\"wp-block-paragraph\">But employers also need to know whether their training works. Cranor said many efforts to educate employees and the public about scams have not been rigorously evaluated.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThey celebrate the number of people who have been trained or have watched their videos, but they rarely do controlled experiments to see whether the training actually protects people,\u201d she said.<\/p>\n<\/div>\n<p>#gap #awareness #company #phishing #trainings #loathe #arent #attacks<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Your first few weeks at work p&hellip; <\/p>\n","protected":false},"author":1,"featured_media":6344,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[587,970,2005,623,1697,537,9454,9452,913,4530,9453,530],"class_list":["post-6343","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-finance-news","tag-arent","tag-attacks","tag-awareness","tag-company","tag-gap","tag-jobs","tag-loathe","tag-phishing","tag-security","tag-training","tag-trainings","tag-workers"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks - Finance News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.vaultinsider.top\/?p=6343\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks - Finance News\" \/>\n<meta property=\"og:description\" content=\"Your first few weeks at work p&hellip;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.vaultinsider.top\/?p=6343\" \/>\n<meta property=\"og:site_name\" content=\"Finance News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-09T07:11:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg?w=2048\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\"},\"headline\":\"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks\",\"datePublished\":\"2026-10-09T07:11:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343\"},\"wordCount\":937,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-1241639569-e1791487787706.jpg\",\"keywords\":[\"Arent\",\"attacks\",\"awareness\",\"company\",\"gap\",\"Jobs\",\"loathe\",\"phishing\",\"security\",\"training\",\"trainings\",\"Workers\"],\"articleSection\":[\"Finance News\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343\",\"name\":\"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks - Finance News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-1241639569-e1791487787706.jpg\",\"datePublished\":\"2026-10-09T07:11:35+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#primaryimage\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-1241639569-e1791487787706.jpg\",\"contentUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/GettyImages-1241639569-e1791487787706.jpg\",\"width\":1200,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=6343#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\\\/\\\/www.vaultinsider.top\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#website\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/\",\"name\":\"Finance News\",\"description\":\"Just another Finance News site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.vaultinsider.top\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\",\"name\":\"admin\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks - Finance News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.vaultinsider.top\/?p=6343","og_locale":"zh_CN","og_type":"article","og_title":"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks - Finance News","og_description":"Your first few weeks at work p&hellip;","og_url":"https:\/\/www.vaultinsider.top\/?p=6343","og_site_name":"Finance News","article_published_time":"2026-10-09T07:11:35+00:00","og_image":[{"url":"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg?w=2048","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"5 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.vaultinsider.top\/?p=6343#article","isPartOf":{"@id":"https:\/\/www.vaultinsider.top\/?p=6343"},"author":{"name":"admin","@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e"},"headline":"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks","datePublished":"2026-10-09T07:11:35+00:00","mainEntityOfPage":{"@id":"https:\/\/www.vaultinsider.top\/?p=6343"},"wordCount":937,"commentCount":0,"image":{"@id":"https:\/\/www.vaultinsider.top\/?p=6343#primaryimage"},"thumbnailUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg","keywords":["Arent","attacks","awareness","company","gap","Jobs","loathe","phishing","security","training","trainings","Workers"],"articleSection":["Finance News"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.vaultinsider.top\/?p=6343#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.vaultinsider.top\/?p=6343","url":"https:\/\/www.vaultinsider.top\/?p=6343","name":"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks - Finance News","isPartOf":{"@id":"https:\/\/www.vaultinsider.top\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.vaultinsider.top\/?p=6343#primaryimage"},"image":{"@id":"https:\/\/www.vaultinsider.top\/?p=6343#primaryimage"},"thumbnailUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg","datePublished":"2026-10-09T07:11:35+00:00","author":{"@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e"},"breadcrumb":{"@id":"https:\/\/www.vaultinsider.top\/?p=6343#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.vaultinsider.top\/?p=6343"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.vaultinsider.top\/?p=6343#primaryimage","url":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg","contentUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/10\/GettyImages-1241639569-e1791487787706.jpg","width":1200,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.vaultinsider.top\/?p=6343#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.vaultinsider.top\/"},{"@type":"ListItem","position":2,"name":"\u2018The gap was not the awareness\u2019: The company phishing trainings you loathe aren\u2019t enough for attacks"}]},{"@type":"WebSite","@id":"https:\/\/www.vaultinsider.top\/#website","url":"https:\/\/www.vaultinsider.top\/","name":"Finance News","description":"Just another Finance News site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.vaultinsider.top\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e","name":"admin","url":"https:\/\/www.vaultinsider.top\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts\/6343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6343"}],"version-history":[{"count":0,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts\/6343\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/media\/6344"}],"wp:attachment":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}