Post #595946

My company's HR routinely sends us e-mails with links we're supposed to click to take surveys, do performance reviews, sign up for benefits, etc. Then my company's #InfoSec team sends sting e-mails to see if we can pick up the subtle difference between HR e-mails and phishing e-mails pretending to be HR e-mails. I guess some of us can't tell the difference, because they keep testing us. Here's my question: Why doesn't Security just tell HR they aren't allowed to send us e-mails with links? Then we would know if we got an e-mail with a link that it was a phishing e-mail and we shouldn't click it. I mean, are they actually trying to stop phishing or not?