Security Awareness Campaign Summary

2019 Cyber Security Awareness Month

Cyber Security Awareness Presentation (PDF)

September 2019 Campaign

The September 17-24, 2019 campaign results are as follows:

  • 3,241 simulated phishing training messages were sent to SF State Employees on Tuesday, September 17, 2019 at 3:50 p.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 9.3% to 14.6%, an increase of 5.3%. 
  • 294 employees (9.1%) reported the message using the Report Phishing feature.
  • Within the first hour, about 140 employees reported the phishing exercise using the Report Phishing feature.

July 2019 Campaign

The July 1-6, 2019 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Monday, July 1, 2019 at 4:00 p.m.
  • The susceptibility rate (those who responded by clicking on the link) decreased from 11.3% to 9.3%, a decrease of 2%. 
  • 277 employees (7.6%) reported the message using the Report Phishing feature.
  • Within the first hour, about 207 employees reported the phishing exercise using the Report Phishing feature.

April 2019 Campaign

The April 9 – 14, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Tuesday, April 9, 2019 at 4:30 p.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 7.55% to 11.3%, an increase of 3.75%.
  • 411 employees (11.3%) reported the message using the Report Phishing feature.
  • Within the first hour, about 208 employees reported the phishing exercise using the Report Phishing feature.

February 2019 Campaign

The February 14 – 19, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Thursday, February 14, 2019 at 9 a.m.
  • The susceptibility rate (those who responded by clicking on the link) decreased from 26.88% to 7.55%.
  • 277 employees (7.6%) reported the message using the Report Phishing feature.
  • Within the first hour, about 188 employees reported the phishing exercise using the Report Phishing feature.

February 2019 campaign response breakdown chart

December 2018 Campaign

The December 3 – 4, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Monday, December 3, 2018 at 11:45 a.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 7.91% to 26.88% due to the increased complexity of the email campaign, an increase of 18.97%. 
  • 153 employees (4.2%) reported the message using the Report Phishing feature.
  • Within the first hour, about 100 employees reported the phishing exercise using the Report Phishing feature.December 2018 campaign response breakdown chart

October 2018 Campaign

The October 2 – 7, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State employees on October 2, 2018.
  • The susceptibility rate (those who responded by clicking on the link) increased from 6.24% to 7.91% due to the increased complexity of the email campaign, an increase of 1.67%. 
  • 552 employees (15.16%) reported the message using the Report Phishing feature.
  • Within the first hour, over 200 employees reported the phishing exercise using the Report Phishing feature.

In August 2018, a campus-wide simulation was run

The August 1 – 8, 2018 campaign results are as follows:

  • 3,622 simulated phishing training messages were sent to SF State employees on August 1, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced from 7.60% to 6.24%, a reduction of 1.35%, which is a minimal reduction to the June simulation.
  • 328 employees (9.06%) reported the message using the Report Phishing feature.
  • Within the first hour, over 200 employees reported the phishing exercise using the Report Phishing feature.

In June 2018, a campus-wide simulation was run

June 14 – 21, 2018 campaign results are as follows:

  • 3,622 simulated phishing training messages were sent to SF State employees on June 14, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced from 16.70% to 7.60%, a reduction of 9.1%, which is a significant reduction to the February simulation.
  • 416 employees (11.49%) reported the message using the Report Phishing feature.
  • Within the first hour, over 250 employees reported the phishing exercise using the Report Phishing feature.

No simulated phishing messages were sent in March 2018 or April 2018

In February 2018, following the start of semester rush, another campus-wide simulation was run

The February 12 – 19, 2018 campagin results are as follows:

  • 3,663 simulated phishing training messages were sent to SF State employees on February 12, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced to 17%, which is a significant reduction to the October test where it was 27%.
  • 13% of employees reported the message using the Report Phishing feature – a slight reduction to the 18% report rate in October.
  • Within 20 minutes over 200 employees reported the phishing exercise using the Report Phishing feature.

No simulated phishing messages were sent in December 2017 or January 2018 due to end of semester/finals and the winter break

In November 2017 a follow-up campaign was run for just those who had clicked on the link (responded) to the October campaign

November 16 – 23, 2017 campaign results are as follows:

  • 943 simulated phishing messages were sent to just employees who clicked on the message sent in the October exercise.
  • – 4% reported the phishing message, 41% clicked on the link in the message, and 4% clicked and reported. The 41% click rate in November was a significant improvement to the equivalent 100% click rate in October.

The Phish Me simulation campaign started in October 2017 and was scheduled to run a pseudo-random simulation approximately every two months

The October 31 – Nov 6, 2017 campaign results were as follows:

  • 
3,516 simulated phishing training messages were sent to SF State employees on October 31st, 2017.
  • 27% of employees responded (not a good sign) to the simulated phishing message and received immediate feedback along with anti-phishing education.
  • 18% of employees reported (good sign) the message using the recently introduced Report Phishing feature.