Security Awareness Campaign Summary

May 2020 Campaign

The May 2020 campaign results are as follows:

  • 3,566 simulated phishing training messages were sent to SF State Employees on Tuesday, May 12, 2020 at 9:10 a.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 1.6% to 5.8%, a net increase of 4.2%.
  • 277 employees (7.7%) reported the message using the Report Phishing feature.
  • Within the first hour, 218 employees reported the phishing exercise using the Report Phishing feature.

The breakdown, by department, of employees who were susceptible is in the table below:



Department Links Clicked Count
Academic Technology 1
Accounts Payable 3
Admissions Office 2
Africana Studies 1
Anthropology 2
Art 7
Asian American Studies 2
Auxiliary Accounting 3
AVP & Dean of Students 1
Biology 9
Broadcast Communication Arts 1
Career Svcs & Leadership Devel 1
CCSC Facilities 1
CEL Academic Programs 5
CEL Administration 3
Child & Adolescent Development 1
Cinema 2
Collection and Recycling 1
Collegewide-Business 3
Collegewide-LCA 2
Collegewide-Science & Engn 1
Communication Studies 3
Computer Lab-Business 1
Computer Science 2
Confucius Institute 1
Counseling 2
Counseling & Psych Services 1
Creative Writing 1
Custodial Services 5
Custodians Housing 2
Customer Services 1
Dean's Office-Business 1
Dean's Office-LCA 2
Dean's Office-Science & Engn 1
Dept of Speech,Lang & Hear Sci 2
Design and Industry 2
Development Office 1
Disability Programs & Res Cntr 1
Division of Graduate Studies 1
DRF-Residential Life 1
Earth & Climate Sciences 2
Educational Doctoral Program 1
Elementary Education 1
Engineering 2
English Language & Literature 3
Enterprise Applications 1
Enterprise Risk Management 3
Environmental Health & Safety 2
EOP Administration 1
Facilities Operations 1
Faculty Affairs 1
FamilyInteriorNutritionApparel 2
Finance 1
Finance & HR Shared Service 2
Fiscal Operations 1
Geography & Environment 3
Graduate Program-Business 1
Grants and Contracts 3
Grounds Housing 2
Grounds Maintenance 1
GS EEP-App Project 1
HDCS Employee & Family Housing 1
HDCS Financial Services 3
HDCS-Housing Dining&Conf Svcs 1
Health Education 2
Health Promotion & Wellness 2
History 2
Inst for Civic Comm Engagement 1
Journalism 2
Kinesiology 3
Laborer Housing 2
Latina/Latino Studies 1
Library Administration 2
Maintenance Housing 1
Management 2
Mathematics 1
Mechanical Maintenance 2
Modern Languages & Literatures 1
Nursing 4
Parking Admin & Operations 2
Philosophy 3
Physical Therapy 2
Physics and Astronomy 1
Political Science 1
PP&D, ITS 1
President's Office 1
Preventive Maintenance Ops 1
Procurement 1
Public Affairs & Civic Eng 2
Quality Assurance 1
Reasonable Accommodations 2
Registrar's Office 6
Research & Sponsored Programs 4
RTC Facilities Operations 1
School of Music 2
Science Service Center 1
Secondary Education 1
Social Work 2
Special Education 3
Structural Maintenance 3
Student Health Services 2
Support Services Housing 1
System Services 4
Telecommunication 1
Theatre and Dance 2
University Communications 1
University Police 2
VP, Stdnt Affrs & Enroll Mgmt 1
Women & Gender Studies 1

The March 2020 campaign results are as follows:

  • 3,566 simulated phishing training messages were sent to SF State Employees on Friday, March 6, 2020 at 3:30 p.m.
  • The susceptibility rate (those who responded by clicking on the link) decreased from 11.3% to 1.6%, a decrease of 9.53%.
  • 185 employees (5.1%) reported the message using the Report Phishing feature.
  • Within the first hour, 123 employees reported the phishing exercise using the Report Phishing feature.

The breakdown, by department, of employees who were susceptible is in the table below:



Department Number of Recipients
Academic Resources 1
Advising Center 1
Auxiliary Accounting 1
Biology 2
CEL Academic Programs 4
CEL Administration 2
Collegewide-Business 1
Collegewide-HSS 1
Computer Science 1
Custodial Services 1
Dean's Office-LCA 1
Dean's Office-Science & Engn 2
Dean's Office-Ungrad Studies 1
Dept of Speech,Lang & Hear Sci 1
Design and Industry 2
Disability Programs & Res Cntr 1
Division of Graduate Studies 1
Earth & Climate Sciences 1
Engineering 1
English Language & Literature 2
Environmental Health & Safety 1
EOP Administration 1
Equity & Community Inclusion 1
FamilyInteriorNutritionApparel 1
Finance 1
Grounds Maintenance 1
Information Security 1
Library Administration 1
Modern Languages & Literatures 1
Nursing 1
Physics and Astronomy 2
Psychology 1
Public Affairs & Civic Eng 1
Reasonable Accommodations 1
Recreation, Parks & Tourism 1
Science Service Center 1
Student Financial Aid 1
Student Health Services 1
System Services 1
Theatre and Dance 1

January 2020 Campaign

The January 2020 campaign results are as follows:

  • 3,566 simulated phishing training messages were sent to SF State Employees on Tuesday, January 7th, 2020 at 4:00 p.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 7.3% to 11.13%, an increase of 3.83%.
  • 209 employees (5.86%) reported the message using the Report Phishing feature.
  • Within the first hour, 168 employees reported the phishing exercise using the Report Phishing feature.

January 2020 PhishMe Breakdown by Units

November 2019 Campaign

The November 2019 campaign results are as follows:

  • 3,241 simulated phishing training messages were sent to SF State Employees on Wednesday, November 6th, 2019 at 4:15 p.m.
  • The susceptibility rate (those who responded by clicking on the link) decreased from 14.6% to 7.3%, a decrease of 7.3%.
  • 447 employees (13.7%) reported the message using the Report Phishing feature.
  • Within the first hour, over 100 employees reported the phishing exercise using the Report Phishing feature.

November 2019 Clicked Phishing Links by Department

2019 Cyber Security Awareness Month

To view PDF files, please download Adobe Reader

Cyber Security Awareness Presentation (PDF)

Request Adobe Acrobat to be able to read PDF files

September 2019 Campaign

The September 17-24, 2019 campaign results are as follows:

  • 3,241 simulated phishing training messages were sent to SF State Employees on Tuesday, September 17, 2019 at 3:50 p.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 9.3% to 14.6%, an increase of 5.3%. 
  • 294 employees (9.1%) reported the message using the Report Phishing feature.
  • Within the first hour, about 140 employees reported the phishing exercise using the Report Phishing feature.

July 2019 Campaign

The July 1-6, 2019 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Monday, July 1, 2019 at 4:00 p.m.
  • The susceptibility rate (those who responded by clicking on the link) decreased from 11.3% to 9.3%, a decrease of 2%. 
  • 277 employees (7.6%) reported the message using the Report Phishing feature.
  • Within the first hour, about 207 employees reported the phishing exercise using the Report Phishing feature.

April 2019 Campaign

The April 9 – 14, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Tuesday, April 9, 2019 at 4:30 p.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 7.55% to 11.3%, an increase of 3.75%.
  • 411 employees (11.3%) reported the message using the Report Phishing feature.
  • Within the first hour, about 208 employees reported the phishing exercise using the Report Phishing feature.

February 2019 Campaign

The February 14 – 19, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Thursday, February 14, 2019 at 9 a.m.
  • The susceptibility rate (those who responded by clicking on the link) decreased from 26.88% to 7.55%.
  • 277 employees (7.6%) reported the message using the Report Phishing feature.
  • Within the first hour, about 188 employees reported the phishing exercise using the Report Phishing feature.

February 2019 campaign response breakdown chart

PhishMe Campaign Summary February 2019

PhishMe February 2019 Bar Chart

December 2018 Campaign

The December 3 – 4, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State Employees on Monday, December 3, 2018 at 11:45 a.m.
  • The susceptibility rate (those who responded by clicking on the link) increased from 7.91% to 26.88% due to the increased complexity of the email campaign, an increase of 18.97%. 
  • 153 employees (4.2%) reported the message using the Report Phishing feature.
  • Within the first hour, about 100 employees reported the phishing exercise using the Report Phishing feature.December 2018 campaign response breakdown chart

October 2018 Campaign

The October 2 – 7, 2018 campaign results are as follows:

  • 3,642 simulated phishing training messages were sent to SF State employees on October 2, 2018.
  • The susceptibility rate (those who responded by clicking on the link) increased from 6.24% to 7.91% due to the increased complexity of the email campaign, an increase of 1.67%. 
  • 552 employees (15.16%) reported the message using the Report Phishing feature.
  • Within the first hour, over 200 employees reported the phishing exercise using the Report Phishing feature.

PhishMe Campaign Summary

October 2018 PhishMe summary

In August 2018, a campus-wide simulation was run

The August 1 – 8, 2018 campaign results are as follows:

  • 3,622 simulated phishing training messages were sent to SF State employees on August 1, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced from 7.60% to 6.24%, a reduction of 1.35%, which is a minimal reduction to the June simulation.
  • 328 employees (9.06%) reported the message using the Report Phishing feature.
  • Within the first hour, over 200 employees reported the phishing exercise using the Report Phishing feature.

In June 2018, a campus-wide simulation was run

June 14 – 21, 2018 campaign results are as follows:

  • 3,622 simulated phishing training messages were sent to SF State employees on June 14, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced from 16.70% to 7.60%, a reduction of 9.1%, which is a significant reduction to the February simulation.
  • 416 employees (11.49%) reported the message using the Report Phishing feature.
  • Within the first hour, over 250 employees reported the phishing exercise using the Report Phishing feature.

No simulated phishing messages were sent in March 2018 or April 2018

In February 2018, following the start of semester rush, another campus-wide simulation was run

The February 12 – 19, 2018 campagin results are as follows:

  • 3,663 simulated phishing training messages were sent to SF State employees on February 12, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced to 17%, which is a significant reduction to the October test where it was 27%.
  • 13% of employees reported the message using the Report Phishing feature – a slight reduction to the 18% report rate in October.
  • Within 20 minutes over 200 employees reported the phishing exercise using the Report Phishing feature.

No simulated phishing messages were sent in December 2017 or January 2018 due to end of semester/finals and the winter break

In November 2017 a follow-up campaign was run for just those who had clicked on the link (responded) to the October campaign

November 16 – 23, 2017 campaign results are as follows:

  • 943 simulated phishing messages were sent to just employees who clicked on the message sent in the October exercise.
  • – 4% reported the phishing message, 41% clicked on the link in the message, and 4% clicked and reported. The 41% click rate in November was a significant improvement to the equivalent 100% click rate in October.

The Phish Me simulation campaign started in October 2017 and was scheduled to run a pseudo-random simulation approximately every two months

The October 31 – Nov 6, 2017 campaign results were as follows:

  • 
3,516 simulated phishing training messages were sent to SF State employees on October 31st, 2017.
  • 27% of employees responded (not a good sign) to the simulated phishing message and received immediate feedback along with anti-phishing education.
  • 18% of employees reported (good sign) the message using the recently introduced Report Phishing feature.

Summary of all PhishMe campaigns

bar chart summary of PhishMe campaigns

table of number of messages submitted via PhishMe reporter