Google guru roasts useless phishing tests, calls for fire drill-style overhaul

Google’s Matt Linton argues that traditional, deceptive phishing tests mandated by some standards bodies erode trust and show little evidence of reducing real phishing success, especially when controls are disabled for testing. He recommends shifting to transparent, fire-drill-like exercises and prioritizing secure-by-default engineering measures—such as passkeys, multi-party approvals, and layered defenses—aligned with UK NCSC guidance to make it harder for attackers to reach users, improve reporting, limit impact, and speed incident response.