Security Awareness Campaign Summary

October 2018 Campaign

  • Results October 2-7, 2018 are as follows:

►3,642 simulated phishing training messages were sent to SF State employees on October 2, 2018.

►The susceptibility rate (those who responded by clicking on the link) increased from 6.24% to 7.91% due to the increased complexity of the email campaign, an increase of 1.67%. 

►552 employees (15.16%) reported the message using the Report Phishing feature.

►Within the first hour, over 200 employees reported the phishing exercise using the Report Phishing feature.

 

 

In August 2018, a campus-wide simulation was run

  • Results August 01-08 2018 are as follows:

►3,622 simulated phishing training messages were sent to SF State employees on August 1, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced from 7.60% to 6.24%, a reduction of 1.35%, which is a minimal reduction to the June simulation.

►328 employees (9.06%) reported the message using the Report Phishing feature.

►Within the first hour, over 200 employees reported the phishing exercise using the Report Phishing feature.

In June 2018, a campus-wide simulation was run

  • Results June 14-21 2018 are as follows:

►3,622 simulated phishing training messages were sent to SF State employees on June 14, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced from 16.70% to 7.60%, a reduction of 9.1%, which is a significant reduction to the February simulation.

►416 employees (11.49%) reported the message using the Report Phishing feature.

►Within the first hour, over 250 employees reported the phishing exercise using the Report Phishing feature.

No simulated phishing messages were sent in March 2018 or April 2018

In February 2018, following the start of semester rush, another campus-wide simulation was run

  • Results February 12-19 2018 are as follows:

►3,663 simulated phishing training messages were sent to SF State employees on February 12, 2018 – the susceptibility rate (those who responded by clicking on the link) reduced to 17%, which is a significant reduction to the October test where it was 27%.

►13% of employees reported the message using the Report Phishing feature – a slight reduction to the 18% report rate in October.

►Within 20 minutes over 200 employees reported the phishing exercise using the Report Phishing feature.

No simulated phishing messages were sent in December 2017 or January 2018 due to end of semester/finals and the winter break

In November 2017 a follow-up campaign was run for just those who had clicked on the link (responded) to the October campaign

  • Results November 16-23, 2017 are as follows:

►943 simulated phishing messages were sent to just employees who clicked on the message sent in the October exercise.

►– 4% reported the phishing message, 41% clicked on the link in the message, and 4% clicked and reported. The 41% click rate in November was a significant improvement to the equivalent 100% click rate in October.

The Phish Me simulation campaign started in October 2017 and was scheduled to run a pseudo-random simulation approximately every two months

    ▪    Results October 31-Nov 6, 2017 were as follows:


►3,516 simulated phishing training messages were sent to SF State employees on October 31st, 2017.

►27% of employees responded (not a good sign) to the simulated phishing message and received immediate feedback along with anti-phishing education.

►18% of employees reported (good sign) the message using the recently introduced Report Phishing feature.