NCC : Almost a quarter of employees would click on a phishing link

23% of people clicked through to a credential entry form when sent a phishing email at work, according to new data from NCC Group.

The global cyber security and risk mitigation expert analysed a selection of emails that were sent using its phishing simulation tool, Piranha, as part of its security testing for corporate clients. The 47,522 emails were sent to 66 companies operating in a broad range of sectors. Of those who clicked on the link in the email, 60% then went on to enter their credentials.

Of these emails, 8,977 were sent by NCC Group's social engineers, and were designed to imitate those that would be sent by an experienced cyber criminal. These used a company branded domain name to make them seem more authentic, and contained a due date to add urgency and encourage users to give away their details. The bespoke emails also mentioned an internal service of the target organisation, and addressed the user by name.

These targeted emails had a higher click through rate than average of 25%, with 75% of those that clicked going on to enter their credentials. The other 38,545 emails were sent by organisations themselves through NCC Group's self-service tool. These were sent using a generic domain name, and resulted in a slightly lower click through rate of 22%. However, 57% of users still entered their credentials after clicking.

Robert Horton, director for global delivery at NCC Group, said: 'The fact that almost a quarter of users clicked on a phishing link, and that the majority of them went on to enter their details, reflects the need for stronger education on cyber security in the workplace.

'Phishing emails are still the most common way for businesses to be attacked, and it is the sophisticated emails that organisations need to be particularly aware of, since these pose the most risks. Those small, initial steps of clicking on a phishing link and entering personal details can give an attacker the foothold that they need to infiltrate an organisation and have a devastating impact.

'These results underline the importance of employee training with regards to identifying malicious emails and questioning links that encourage users to disclose usernames, passwords, or other sensitive details.'

Published date: 08 January 2018