Implementing Anti Phishing Training Program

SANS Security Awareness Maturity Model

• Level 1: Non-existent - No program
• Level 2: Compliance-focused - Annual checkbox training
• Level 3: Promoting Awareness - Engaging, regular content
• Level 4: Long-term Sustainment - Continuous program with culture change
• Level 5: Metrics Framework - Risk-based measurement and optimization

Implementation Steps

Step 1: Establish Baseline

• Run initial phishing simulation across all departments
• Measure click rate, submit rate, and report rate
• Identify high-risk departments and roles

Step 2: Design Curriculum

• General awareness: Phishing identification basics for all employees
• Role-specific: Finance (BEC/wire fraud), IT (credential phishing), Executives (whaling)
• Progressive difficulty: Beginner, intermediate, advanced modules
• Micro-learning: Short (3-5 minute) frequent sessions vs. annual marathon

Step 3: Deploy Training Platform

• Configure KnowBe4/Proofpoint SAT with organizational groups
• Set up automated enrollment workflows
• Integrate with LMS for completion tracking
• Configure reporting dashboards

Step 4: Run Continuous Simulations

• Monthly simulations with varied scenarios
• Increase difficulty based on organizational performance
• Include diverse attack types: links, attachments, QR codes, BEC

Step 5: Measure and Optimize

Use scripts/process.py to analyze training completion, simulation results, and program effectiveness over time.

Tools & Resources

• KnowBe4: https://www.knowbe4.com/
• Proofpoint Security Awareness: https://www.proofpoint.com/us/products/security-awareness-training
• Cofense PhishMe: https://cofense.com/
• SANS Security Awareness: https://www.sans.org/security-awareness-training/
• Terranova Security: https://terranovasecurity.com/

Validation

• 90%+ training completion rate across organization
• Measurable reduction in phishing click rate over 6 months
• Increase in user phishing report rate
• Department-level improvement tracking