Hacker News Reader

I have a client in the banking industry who performed these tests. Everyone failed. I'm not sure if they ran them again but there's a point where you need to sit someone down and explain how serious the situation is. If they still don't get it, you should probably fire them or transfer them to a department that isn't vulnerable.

View on HN

It's possible to both get it and still be fooled.

Did they run the tests without training first?

What’s the point?

If Security/IT is so dense that they see any value in testing before training, we’ve already identified a problem: culture or a “our employees are too smart for this issue”.

> Did they run the tests without training first? What’s the point?

How do you know if your training is working if you have no baseline?

They said they weren’t sure if the tests were run again. I hope they were after the training for that reason.

I’m also curious about what training methods work best (including a no-training control group).

Reply on news.ycombinator.com