Should Failing Phish Tests Be a Fireable Offense?
Summary: Krebs on Security asked phishing experts about employers that fire workers for repeatedly failing phishing tests, and both John LaCour of PhishLabs and Rohyt Belani of Cofense said punitive programs are counterproductive. LaCour said such policies are rare and that companies instead use classroom training, manager sit-ins, or revoked network access, while Belani said threats make employees less likely to report a real phishing click.
What you should know: Belani's point is the one to sit with: an employee who clicks a real phishing link and knows a punitive policy exists is more likely to hide it and demand proof than to report it, which turns your detection program into a silence generator.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026