Why Controversial Phishing Emails Do Not Work

This article advises security awareness teams to avoid highly controversial simulated phishing lures (e.g., layoffs, bonuses) that inflame employees and damage program credibility, noting that real attackers typically favor less inflammatory messages to avoid rapid detection. It recommends focusing on value-driven, realistic simulations aligned with actual threats (e.g., leveraging defanged real phishing via tools like PhishFlip), engaging leadership before sending sensitive themes, and prioritizing reductions in human risk over maximizing click rates.