{"id":91993,"date":"2020-10-05T09:00:05","date_gmt":"2020-10-05T16:00:05","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=91993"},"modified":"2025-06-25T07:06:47","modified_gmt":"2025-06-25T14:06:47","slug":"why-integrated-phishing-attack-training-is-reshaping-cybersecurity-microsoft-security","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/10\/05\/why-integrated-phishing-attack-training-is-reshaping-cybersecurity-microsoft-security\/","title":{"rendered":"Why integrated phishing-attack training is reshaping cybersecurity\u2014Microsoft Security"},"content":{"rendered":"\n

Phishing is still one of the most significant risk vectors facing enterprises today. Innovative email security technology like Microsoft Defender for Office 365 stops a majority of phishing attacks before they hit user inboxes, but no technology in the world can prevent 100 percent of phishing attacks from hitting user inboxes. At that point in time, your employees become your defenders. They must be trained to recognize and report phishing attacks. But not all training is equally proficient.<\/p>\n\n\n\n

This blog examines the current state of security awareness training, including how you can create an intelligent solution to detect, analyze, and remediate phishing risk. You\u2019ll also learn about an upcoming event to help you get data-driven insights to compare your current phishing risk level against your peers.<\/p>\n\n\n\n

A new reality for cybersecurity<\/strong><\/p>\n\n\n\n

The Chief Information Security Officer (CISO) at a modern enterprise must contend with a myriad of threats. The hybrid mix of legacy on-premises systems and cloud solutions, along with the proliferation of employee devices and shadows, means your security team needs a new and comprehensive view of phishing risk across the organization. Self-reported training completion metrics don\u2019t provide insights into behavior changes or risk reduction, leading CISOs to distrust these metrics. Improvement in employee behavior becomes difficult to measure, leaving them anxious that employee behavior has improved at all.<\/p>\n\n\n\n

Many information workers view security awareness training as a tedious interruption that detracts from productivity. Often when an employee is compromised during a simulated attack, they find the ensuing training to be punitive and navigate away from the training like nothing happened. Worse, simulations are often out-of-context and don\u2019t make sense for the employee\u2019s industry or function.<\/p>\n\n\n\n

People-centric protection<\/strong><\/p>\n\n\n\n

Making secure behaviors a part of people\u2019s daily habits requires a regular program of targeted education combined with realistic simulations. That means regular breach and attack simulations against endpoints, networks, and cloud security controls. Microsoft Defender for Office 365 now features simulations to help you detect and remediate phishing risks across your organization. Attack Simulation Training in Microsoft Defender for Office 365, delivered in partnership with Terranova Security, helps you gain visibility over organizational risk, the baseline against predicted compromise rates, and prioritize remediations. To learn more about this capability, watch the product launch at Microsoft Ignite 2020<\/a><\/p>\n\n\n\n

Terranova Security employs a pedagogical approach to cybersecurity, including gamification and interactive sessions designed to engage users\u2019 interest. The simulations are localized for employees around the world and follow the highest web content accessibility guidelines (WCAG) 2.1. You will be able to measure employee behavior changes and deploy an integrated, automated security awareness program built on three pillars of protection:<\/p>\n\n\n\n