Explore a finding from the report, see the employee reminder it informs and take the poster back to your team.
Pick a poster, read the report finding behind it and download the file for your team.
One offer advertised a hosted phishing dashboard with a template library and separately billed messaging.
The catalogue records an advertisement. Trial delivery, template count and functionality were not independently verified.
When a request is unusual, confirm it using a contact method you already know.
Claimed field lists included names and email addresses. A separate offer listed identity-document and selfie options.
The statements do not confirm database contents, document authenticity or one matched identity.
A familiar detail does not settle an unusual request. Verify it through contact details you already know.
A buy-side rate sheet requested account names, passwords, and cookies or a two-factor authentication secret.
The request does not establish that anyone supplied the data, received payment or obtained working account access.
Report unexpected sign-ins or account changes through your organization's approved channel.
Something feels off? Report it through your organization's approved channel.
Offers and claimed fields describe what posts said, not verified records or working services. The employee reminders follow NIST guidance; this study did not test their effectiveness.
Read the employee guidance from NISTSVG files use A2 proportions and an embedded font. PNG files are previews.
Start with the research context, try a fictional situation and discuss two questions. Before starting, tell the team which approved reporting channel to use. Keep real passwords, account files and authentication codes out of the exercise.
The report records an offer of a hosted phishing dashboard with templates and separately billed messaging. It does not prove deployment or a working service.
A message appears to come from your manager. It asks you to approve an unexpected request before a meeting.
Pause and verify the request using contact details you already know. Follow your organization’s approved reporting process.
An urgent message still needs a trusted check.
Employee responses follow NIST phishing guidance on trusted verification and organizational reporting. The scenarios are fictional discussion exercises, not reported incidents. This package has not measured training effectiveness.
Read the NIST phishing guidanceCompare hosted services, worker accounts, access transfer and account-data requests in our cross-chapter analysis.
Explore the work and control analysis ↗
