The vast majority of successful attacks against firms stem from phishing emails. Traditional user training is often largely ineffective at preventing users clicking on these phishing emails, and users are not as good as they think they are at spotting phishing emails - with as many as 1 in 4 staff clicking on phishing emails.

For this reason it is absolutely essential all firms conduct phishing testing against their own users, but it is just as essential to ensure it is done properly if you want it to be effective. There are pitfalls to be avoided if you want this to be successful. Testing should be conducted with the aim of making your organisation more secure, not done just to put a tick in a box to meet a regulatory requirement.