Written By: Frank Saulsbery
THE LATEST THOUGHTS FROM THE FOUNDER
A running column from Frank Saulsbery. Not a sales pitch, just the way he’d explain it if you pulled up a stool next to him. Meet Frank →
A SNEAK PEEK…
“It is far better to let someone make a harmless mistake in a controlled test than to have that same mistake happen during a real attack.”
Why would I test my employees with fake phishing emails? Isn’t that a little like setting them up to fail? That question usually comes from a good place, you trust your people. They work hard, they care about the company, and the last thing you want is to feel like you’re trying to trick them.
And honestly, I understand that hesitation. Nobody likes the idea of being tested, especially in the middle of a busy workday when you are already juggling too much. It can feel like one more thing piled on top of everything else.
But here’s the reality that catches a lot of business owners off guard. Most security problems today don’t start with some highly technical hacker breaking through a firewall. They start with a simple email that looks perfectly normal.
It might look like it came from Microsoft asking someone to log in. Or Amazon confirming a purchase. Or even a message that appears to come from you, asking for a quick favor. And the reason those emails work is not because your team isn’t smart, it is because they are busy.
When people are moving fast, trying to stay on top of deadlines, and sorting through dozens or even hundreds of emails, it is very easy to click something without slowing down to think about it. That is not a failure of intelligence. It is just human nature.
That is exactly why phishing testing exists. It is not about catching people making mistakes. It is about showing, in a safe and controlled way, just how convincing these emails can be. The test emails are designed to look realistic. They might ask someone to log into an account, click a link, or enter information. But instead of leading to a real attack, they simply record what happens.
If someone clicks or enters information, nothing bad actually happens. There is no breach, no lost data. Instead, it creates a learning opportunity. That person may receive a quick training or reminder. Sometimes the whole team gets a refresher.
Over time, you start to see a shift, people become more cautious. They pause for a second before clicking. They question emails that feel just a little off. And that small change in behavior can prevent a very real and very costly mistake down the road.
Now, here is an important point that often gets overlooked. The goal is not to embarrass anyone. In fact, when this is done well, it is handled quietly and respectfully. The focus is on awareness, not blame. It also needs to be done thoughtfully. If you run these tests too often, people start talking, comparing notes, and the whole thing becomes a game. That defeats the purpose. Spacing them out and keeping them realistic makes the training far more effective. And not every business needs to run these constantly. If you are a very small team with simple systems and low exposure, occasional training may be enough. But if your team handles customer data, financial information, or has access to important systems, this becomes much more relevant.
One thing I always tell business owners is this. It is far better to let someone make a harmless mistake in a controlled test than to have that same mistake happen during a real attack. If you think about your own team for a moment, how likely is it that someone, on a busy day, might click a link that looks legitimate without taking a second look? That is not a criticism. It is just an honest reflection of how work gets done.
If this is something you have not explored yet, it may be worth starting with a simple awareness approach. Even just having the conversation with your team about what to watch for can go a long way. And if you do decide to test, frame it as a way to protect the business and support your people, not judge them.
Sometimes the best security improvements come from small shifts in awareness, not big changes in technology.
That’s how I see it, anyway, and I’d enjoy hearing how you see it. None of this is a sales pitch. It’s just the kind of thing I’d talk through with you if we were sitting across the table. If it raised a question, or you think I have it wrong, I want to hear about it.
My door is always open. Whether you want to talk this through or just say hello, you can reach me anytime.
Network Solutions Unlimited is a generational managed IT services provider based in Decatur, Illinois, serving businesses and nonprofits with genuine support and decades of trusted relationships. Led by Baily Saulsbery and founded by her father Frank, we're not just your IT provider; we're your neighbors who happen to be really good at technology. Contact us today to experience IT support that actually cares.
