Defending People
Turn the softest target into a sensor grid with training, reporting, and controls.
What you will learn
- -Design awareness training that changes behavior, not just compliance
- -Build a reporting culture that treats users as sensors
- -Layer technical controls that blunt phishing and impersonation
You cannot patch a person, but you can train, measure, and back them up. The goal of defense is not a workforce that never gets fooled. That does not exist. The goal is a workforce that notices, reports fast, and is caught by technical when they slip. Done right, the human attack surface becomes a sensor grid.
Training that actually changes behavior
Annual click-through slides are theater. Behavior changes when training is frequent, specific, and tied to real feedback:
- Simulated phishing: send your own authorized test emails, then coach anyone who clicks in the moment. The teachable second is right after the click.
- Role-relevant scenarios: finance sees wire fraud, engineers see fake code reviews, HR sees fake resumes with macros.
- Short and recurring: a five minute nudge each month beats a two hour session once a year.
- No blame: shame makes people hide mistakes. You want them reported, not buried.
Most programs only track who clicked. Track who reported instead. A rising report rate means your users are becoming detectors. A team that clicks a little but reports within two minutes is far safer than one that clicks nothing on the test and stays silent on the real thing.
A reporting culture
Speed of detection decides how bad an gets. A phished at 9:00 and reported at 9:03 can be contained before the attacker in. The same credential reported next week is a breach. Make reporting the path of least resistance:
- Give people a one-click report phish button in the mail .
- Thank every report, even the false alarms. Punishing kills the signal you need.
- Close the loop: tell reporters what happened so they see their report mattered.
$grep -Ri 'reply-to' reported_email.eml$dig +short txt targetcorp.com | grep spf$urlscan.io lookup hxxp://suspicious-linkTechnical controls that catch the slip
Awareness is one layer. Assume it fails sometimes and controls behind it:
- Email : enforce SPF, DKIM, and DMARC so spoofed sender rejected or quarantined.
- Phishing-resistant : FIDO2 security keys do not hand a code to a fake page the way SMS codes do.
- : a phished account that can reach little limits the blast.
- Visitor and badge : escort visitors, challenge tailgaters, and migrate off legacy prox cards.
- and web filtering: block known malicious domains before the click lands.
Team A clicks 0 percent on the phishing test but never reports. Team B clicks 8 percent but reports within two minutes. Which team is safer against a real campaign, and why?
Team B. A real attacker only needs one click, which no training drives to zero. Team B's fast reporting means the security team can revoke sessions and reset credentials before the attacker acts. Team A's silence gives an attacker free time.
Which technical control most directly stops an attacker from spoofing your own domain in the From address?