John Wilson, Senior Fellow for Threat Research at Fortra, explains in Help Net Security that effective phishing training should focus on the social engineering tactics that consistently drive attacks, not the latest phishing lure. He argues that click rate is the most important measure of training effectiveness because a single click can lead to compromise. The article highlights why organizations should prioritize training that builds long-term resilience against evolving phishing threats.
"While there have been numerous technical innovations in phishing, such as Device Code phishing, Hybrid Vishing, Phishing-as-a-Service, Service Abuse, and OAuth client ID spoofing, the underlying social engineering techniques of urgency, authority, fear, greed, etc. haven’t changed. Phishing simulation training needs to focus on these core social engineering techniques, rather than any specific phishing lures, which will no doubt continue to adapt and evolve over time." — John Wilson
