Practice phishing at work

Your organization uses HumanRisk Shield to send practice phishing emails now and then. They look like real phishing because that is the only way practice helps. Nobody is trying to catch you out: the point is to make reporting a habit, so that when a real attack arrives you spot it and say so.

If you report it

Report it the same way you would report a real one. See Report a suspicious email. You'll be told you caught a practice email, and that's it.

Reporting is the result your organization is hoping for. It counts in your favor, more than simply ignoring the message does, because ignoring an attack and catching one are not the same thing.

If you click

You'll land on a short page that says it was an authorized simulation by your company. It shows you the message, points out what gave it away, and suggests one thing to do next time. It takes about a minute.

That's all. The page doesn't scold you, and it won't describe something that didn't happen. If you clicked but didn't type anything, it won't talk about stolen passwords.

If you typed something into the page

Some practice emails lead to a page that looks like a sign-in screen. If you typed a username or password into it, what you typed was not stored. The page records that a form was submitted and throws the contents away.

It's still a good idea to change that password if you typed a real one, simply because it's a habit worth practicing.

What is recorded

For each practice email, HRS records whether it was delivered and whether you opened it, clicked, submitted the form or reported it, with times. Location is recorded at country and network level, never your city. The page you land on after a click also records that you visited it.

These results feed your personal risk score, which you can see on your dashboard in HRS Learn as Personal risk. Lower is safer. Clicking raises it; reporting lowers it. It is updated overnight.

Who sees your results

• You see your own score and phishing practice summary on your dashboard.
• Your organization's admins see individual results so they can offer training where it helps.
• Your manager may be brought in if you repeatedly fall for practice emails, and only if your organization has set up reporting lines. What HRS gives managers is a coaching guide for a conversation, not a disciplinary process.

Outside your organization, the only people who can see them are an IT provider that runs HRS on your organization's behalf, if you have one, and HRS support staff during a support case, with time-limited access that is logged. If you have questions about how your organization uses them, ask your HR or IT team. See also Questions from employees.