Conversation

In re comparing fire drills to phishing tests[1], if phishing tests were like fire drills, they would test the *response* to a successful phish. Was the person phished able to rapidly report and mitigate things? Do the organization's phish alarms work and reach people? Etc etc.

Current "phishing tests" are like testing people to see if they accidentally start fires if they're handed (dangerously) flammable materials. That's not a fire drill.

1: https://infosec.exchange/@sambowne/112513766095541271