About the Client
A regional banking institution with a growing digital presence partnered with CyberSapiens to assess and strengthen its cyber security awareness. With over 50 employees handling customer data, internal banking systems, and digital transactions, the bank recognized the need for proactive defense against phishing attacks targeting both its staff and infrastructure.
Objective
- Simulate Realistic Threats – Conduct phishing simulations that closely mimic real-world banking-related attack vectors.
- Train and Educate Staff – Improve employees’ ability to recognize, report, and respond to phishing attempts through targeted awareness campaigns.
- Measure and Reduce Risk Exposure – Establish a baseline for employee susceptibility and reduce phishing risk through repeat testing and training.
The Challenge & Its Solution
The bank sought to improve its security awareness by conducting phishing simulations and training employees to recognize threats more effectively. Attackers often attempt to impersonate internal staff or trusted partners, making it crucial to enhance employee vigilance against such threats.
PhishCare addressed these challenges by:
- Created and deployed three distinct phishing campaigns using custom domains and templates tailored to the banking context (e.g., internal transfer requests, login alerts, vendor payment notifications).
- Delivered awareness training sessions to all employees who interacted with phishing emails.
- Implemented a follow-up simulation to evaluate the effectiveness of the training.
Key Findings & Observations
Simulation
- Out of 50+ employees, 5 members were successfully phished.
Awareness Module Attendance
- All affected users were enrolled in PhishCare’s awareness training module, which included a phishing video, examples, and a knowledge-based assessment.
Improvement Through Awareness:
- During the second round of simulations, the phishing success rate dropped by 85%.
- Email reporting behaviour improved, with several employees flagging suspicious messages to IT before interacting.
Conclusion
The implementation of PhishCare provided the bank with valuable insights into its phishing vulnerabilities. By combining phishing simulations, and training programs, the bank strengthened its ability to detect and respond to phishing threats.
PhishCare’s tailored campaigns, measurable outcomes, and hands-on training created a feedback loop of awareness and accountability — a vital asset in the high-risk, fast-moving banking sector.
