77% of security leaders say they'd fire staff who fall for phishing scams, even though they've done the same thing

"While enterprises place a huge emphasis on educating workers to look out for phishing scams, the worst offenders when it comes to clicking malicious links are actually security leaders themselves. That's according to new research from Arctic Wolf, which found that despite three-quarters of IT and security leaders believing their organization wouldn't fall for a phishing attack, nearly two-thirds click phishing links."

"Yet despite their own poor record, 77% of IT leaders say they would fire staff who fall for scams, marking not only a double standard but a sharp increase from 66% in 2024. More than six-in-ten of IT leaders have changed employees' access or limited their access as a result of falling victim to phishing scams. Arctic Wolf said a better strategy to combat the rise of phishing attacks lies in more robust training for staff at all levels."

"Indeed, companies that emphasize corrective training reported an 88% reduction in long-term risk. "Terminating employees for falling victim to a phishing attack may feel like a quick fix, but it doesn't solve the underlying problem," said Marrè. "Our research shows that better-trained and better-equipped end users are far less likely to be duped - and when organizations take an education-first approach, nearly nine in ten see positive outcomes.""

Security leaders exhibit high susceptibility to phishing, with nearly two-thirds clicking malicious links and one-in-five failing to report incidents. Seventy-seven percent of IT leaders say they would fire staff who fall for scams, and over 60% have reduced or limited employee access after phishing incidents. Emphasizing corrective, education-first training correlates with large reductions in long-term risk, with companies reporting an 88% reduction when training is prioritized. Terminating employees for falling victim often fails to address root causes; better-trained and better-equipped end users are far less likely to be duped and deliver more positive security outcomes.

Read at IT Pro