The sad part is it's one of the hardest components to solve. High quality training can instill a healthy dose of paranoia, that is necessary, though.
With crap like that it isn't all that strange that some of these attempts get through and on the social engineering side it can't be all that much better. After all we're continuously conditioned to trust that which we really shouldn't be trusting. Right up to the point where the party on the other side is abusing that trust.
One example: my real bank calling me and then asking me to verify that it is really me by asking me all kinds of information about my account... And from a number that isn't associated with them. And yet, it was very real and when I refused to answer their questions they took it pretty badly as though I was a scammer...
Employees get really good at spotting the tests.
It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests.
I actually found KnowBe4 to work fairly well on a large scale.
It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.
Ooof, that'd be a tough one not to fall for.
Then surely either the test isn't good enough, or the problem is solved?
They have a similar concept in cybersecurity.
The Red Team
> a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies.