The situation
A large enterprise in a highly sensitive industry, with over 5,000 employees, had invested heavily in security infrastructure, firewalls and intrusion prevention. A third-party penetration test still found a different reality.
Testers ran four attack scenarios at once: external sources, internal access, valid account misuse and endpoint compromise. For the external attack, they used public information such as job postings and customer service data to craft targeted phishing emails.
The test made one thing clear: the greatest risk lay in the habits and awareness of the people using the technology.
Two years with Safemind
- 325phishing campaigns carried out during training
- 75,000+simulated phishing emails sent to employees
- 100+learning videos with real-world scenarios
“We deployed multiple sophisticated and compelling scenarios using a variety of techniques, but detected no signs of compromise. The entire phishing campaign had to be redesigned from scratch.”
The returning red team
