What We Do
How we do it
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
Nov 21, 2022
ProxyNotShell Exploit Released
THE THREAT eSentire is aware of public Proof-of-Concept (PoC) exploit code for the ProxyNotShell Exchange vulnerabilities (CVE-2022-41040 [CVSS:8.8], CVE-2022-41082 [CVSS:8.0]). The publication of…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Nov 07, 2022
Global Cybersecurity Leader eSentire Partners with InfoTrust to Deliver 24/7 Multi-Signal MDR and IR Services Across Australia
Waterloo, ON and Sydney, Australia – November 9, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has expanded its presence in Australia via a strategic partnership with InfoTrust. InfoTrust is a leading specialized cybersecurity provider that combines next-generation security controls, with the InfoTrust “Connective Tissue” of customer success,…
Read More
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Dec 21, 2021


Ep. 7: Security Awareness Training and Phishing Testing

4 minutes read
Speak With A Security Expert Now

Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.

Want to listen to the full episode instead? Click here.

Most of the devastating cyberattacks begin with a phishing email that tricks a user into aiding the threat actor. To increase resilience against this tactic, organizations turn to security awareness training and phishing testing. Often, these testing programs are combined into Phishing and Security Awareness Training (PSAT), typically structured as a set of lessons, tests, and simulations designed to teach employees how to avoid falling prey to phishing attempts and other cybersecurity threats.

PSAT programs recognize that behind all the technology that is often at the center of cybersecurity discussions, there are people—and those people can be manipulated and tricked by clever cybercriminals. But PSAT programs are not created equal, nor are they as simple as many people think, which means many organizations are not getting the results they want (or need).

As Mark Sangster, our VP Industry Security Strategy, put it in a recent Managing Cyber Risk podcast, “PSAT is something every company is likely doing [so the question becomes,] are they doing what’s necessary and moving the needle?”

Moving beyond a compliance mindset

Companies in highly regulated industries (e.g., healthcare and finance) or those that have a large number of professionals licensed by a governing body (e.g., doctors, accountants, engineers) are more likely to have a formal PSAT program as part of their compliance activities.

However, PSAT should be about business outcomes—about reducing risk and the consequences associated with cybersecurity events—and a compliance mindset can create a false sense of security.

Moreover, a risk-based approach to cybersecurity allows business leaders to direct investments in the most effective way with the goal of reducing risk over time. In a world of scarce resources, this approach leads to superior cybersecurity outcomes when compared to maturity-based or compliance-based approaches.

In Mark’s words, “When it comes to a successful program, it’s not about an hour of class time a year or making up a couple of fake phishing emails. You really need an integrated approach that’s manageable and that provides information you can feed up the chain to the C-suite or your board to demonstrate that you are delivering value—that you are reducing risk.”

Why do so many PSAT programs fail to achieve the desired outcomes?

Perhaps the biggest reason why many PSAT initiatives don’t deliver the desired results is because they start with an underlying assumption that users are irresponsible or stupid, and this fundamentally flawed premise shapes ‘training’ that is little more than definitions, jokes, and generic examples that are easy to spot. All that such training achieves is reiterating the stereotype that victims are at fault.

While it’s all-too-common to scapegoat employees for their mistakes, or to act like threats are self-evidently obvious, the reality is that cybercriminals are extremely skilled at disguising their lures. So, the first step in conducting effective Phishing and Security Awareness Training is to recognize and accept that:

Look at your employees as an important part of the solution to a problem that has claimed many sophisticated victims and treat your team with the respect that is warranted of such a crucial role. Then, make sure your team is aware of the six common causes of failure that have undermined many PSAT initiatives and ensure you don’t fall victim to them.

What makes a PSAT program effective?

It’s critical that PSAT programs leverage realistic threat scenarios that foster context-relevant (e.g., tailored to your industry and risks) security awareness, rather than using commoditized and easy-to-spot templates that are increasingly relics of the past.

Consider the structure of the program and look for programs that:

Effective PSAT programs deconstruct the tools, techniques, and procedures (TTPs) that cybercriminals employ using relevant examples.

Mark speaks with many business leaders, and he often must remind them that PSAT is more important and more involved than they initially perceive it to be.

“This isn’t a simple thing to do. A lot of people in the security world think it is: buy a tool, choose from some templates, do a presentation once a year. It’s far more than that—it’s about creating a comprehensive program and demonstrating that you’re protecting the business.”

Remember, PSAT is about real business outcomes, not simply checking a box.

Learn more about implementing your own PSAT program

Listen to the full Security Awareness Training and Phishing Testing episode of the Managing Cyber Risk podcast series as Mark Sangster and Hillarie McClure discuss cybersecurity awareness training and phishing testing, how these help improve business resiliency by reducing the risks associated with human-targeted attacks, commonly held misconceptions about these important programs, and much more.

View Most Recent Blogs

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.