[{"data":1,"prerenderedAt":169},["ShallowReactive",2],{"publication:en:P084":3},{"meta":4,"copy":17,"relatedArticles":128,"terms":161,"term":162,"resourceParent":163,"glossaryParent":166},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P084","\u002Fblog\u002Fbusiness-phishing-exercise","article","phishing training exercise for small business","Phishing training exercise for small business: practice safe reporting","Phishing training exercise for a small business","Run a safe tabletop with fictional messages, clear reporting and useful measures. Plan active simulations separately and avoid collecting real credentials.",[13,14],"\u002Fservices\u002Faccess-2fa-audit","\u002Fservices\u002Femail-domains","2026-06-14","2026-10-30",{"intro":18,"sections":19,"checklist":88,"faq":94,"links":104,"sources":121,"cta":123},"A phishing training exercise for a small business should rehearse one useful behavior, such as reporting an unexpected access request or verifying a supplier change. Start with fictional messages in a tabletop discussion, an agreed owner and a clear debrief. An active email simulation needs separate authorization, privacy and technical scope; it should never collect real passwords or be treated as a guaranteed measure of staff security.",[20,25,61,66,75,83],{"title":21,"paragraphs":22},"Choose one behavior and define what success looks like",[23,24],"A useful exercise asks whether the team can perform a specific safer action. Examples include finding the reporting contact, opening a known portal separately or holding an unverified supplier change. Avoid an objective as vague as catch every phishing message. Choose the workflow, the people who own it and the evidence that would show the handoff worked in the proposed scenario.","Write the success condition before presenting the message. For example, the recipient identifies the requested action, pauses it and sends a clear report to the designated owner. The owner then acknowledges the report and explains who can authorize the change. This makes the exercise about an observable process rather than guessing whether an employee was sufficiently suspicious or labeling them a security risk.",{"title":26,"paragraphs":27,"table":30},"Start with a synthetic tabletop that needs no live deception",[28,29],"Prepare a fictional message using made-up organizations, non-operational destinations and invented transaction details. Ask participants what they would do, where they would find the trusted contact and what they would include in a report. Do not send the message as a real external campaign, collect credentials or require anyone to open a destination. The discussion can reveal missing owners without creating a new incident.","Our tabletop worksheet is a proposed exercise aid. It is not a commercial implementation of the NIST Phish Scale, a reproduction of its worksheets or a claim that a training session was delivered. Keep the scenario short enough for staff to explain the business action in plain language. Record the workflow gap and its owner instead of scoring an individual's personality or technical confidence.",{"caption":31,"headers":32,"rows":36},"Fictional tabletop planning and observation worksheet",[33,34,35],"Field","Plan before the exercise","Useful observation",[37,41,45,49,53,57],[38,39,40],"Objective","One action, such as verify a supplier change.","Can participants explain the intended safe action?",[42,43,44],"Scenario","Invented message and non-operational details.","Does the request resemble relevant work?",[46,47,48],"Owner and deputy","Who receives reports and handles absence.","Can staff find the route without the message?",[50,51,52],"Authority","Who may approve the proposed change.","Is identity kept separate from permission?",[54,55,56],"Evidence","Minimal process notes with controlled access.","Are unknowns and missing handoffs recorded?",[58,59,60],"Follow-up","Named owner and a realistic completion date.","Can the corrected process be rehearsed again?",{"title":62,"paragraphs":63},"Scope an active simulation as a separate activity",[64,65],"A live simulation is different from discussing a fictional message. It can affect mail filtering, external providers, employees and stored personal data. Before anyone sends it, define written authorization, the permitted recipients, infrastructure, timing, exclusion rules, stop contact and evidence handling. Consider staff communication and applicable workplace requirements. A supplier's advertised feature list does not provide this organizational authorization.","Keep real credentials, operational secrets and sensitive impersonation media out of the exercise. Do not impersonate a colleague through a voice clone merely to make the test harder. Agree how a real incident discovered during the activity will be distinguished and escalated. An exercise should not weaken production filtering broadly or persuade staff that normal reporting channels cannot be trusted.",{"title":67,"paragraphs":68,"sources":71},"Interpret results in the context of the scenario",[69,70],"NIST TN 2276 explains that an email's detection difficulty depends on cues and how its premise aligns with the recipient's context. The guide cautions against interpreting click results without that difficulty context. This means a different scenario can produce a different result without establishing that the organization became safer or less safe. Do not present one click rate as a complete business-risk measure.","Use a small set of process observations: whether reports reached an owner, whether the owner responded and whether the sensitive action remained controlled. In a small group, one person's action can noticeably change a percentage, and individuals may be easy to identify. Keep interpretation proportionate. If you intend commercial use of the formal Phish Scale, review NIST's licensing terms rather than assume that referencing the research grants permission.",[72],{"label":73,"url":74},"NIST TN 2276 (2023): phishing detection difficulty and training context","https:\u002F\u002Ftsapps.nist.gov\u002Fpublication\u002Fget_pdf.cfm?pub_id=956851",{"title":76,"paragraphs":77,"example":80},"Debrief the handoff and repair the process",[78,79],"A debrief should explain the requested action, the expected verification route and what happens after a report. Give people a way to describe uncertainty without public embarrassment. If the reporting mailbox was unattended or the deputy could not approve the change, assign that operational gap to an owner. Repeating the same scenario without repairing the missing handoff adds little practical value.","Keep only the notes needed for improvement, with appropriate access and retention agreed in advance. A private report should not become an open ranking of employees. Record the action, responsible person and how the correction will be checked. The next rehearsal can test the corrected route using a different fictional situation while preserving the same learning objective.",{"title":81,"text":82},"Illustrative example: a correct pause with nowhere to report","In a proposed tabletop, a fictional employee holds a supplier-change request but cannot identify the reporting deputy. The team assigns a finance backup, confirms where the trusted supplier contact is stored and rehearses the handoff again. The finding concerns an incomplete process, not an employee failure. No simulation was sent and no training effectiveness result is claimed.",{"title":84,"paragraphs":85},"Connect awareness to the technical controls it depends on",[86,87],"Staff need understandable processes, but technical ownership still matters. Review who controls shared inboxes, who may grant application access and how account recovery reaches the business owner. Domain authentication and supported account protection can reinforce the workflow; neither removes the need for transaction approval. Keep the exercise's action list tied to controls the organization can actually maintain.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli technical knowledge. Our published services cover scoped website, email and account-control work. This guide offers a planning framework, not a claim that we operate a managed phishing-simulation platform or have delivered specific training programs. Discuss the actual technical scope and responsibilities rather than assume an ongoing awareness service or guaranteed outcome.",[89,90,91,92,93],"Choose one observable behavior and a responsible owner.","Use fictional details for the first tabletop.","Plan authorization and privacy separately for any live simulation.","Interpret results with scenario difficulty and small-group limits.","Repair the reporting or approval handoff and rehearse it again.",[95,98,101],{"question":96,"answer":97},"Do we need to send deceptive emails to begin?","No, a fictional tabletop can test reporting, trusted contacts and approval authority without live delivery, credential collection or production-system changes.",{"question":99,"answer":100},"Does a low click rate prove the business is secure?","No, scenario difficulty, context and reporting behavior matter, and a single exercise does not assess every technical control or real attack.",{"question":102,"answer":103},"Is the worksheet on this page the NIST Phish Scale?","No, it is an original planning aid for a fictional tabletop. The formal NIST method has its own scope and licensing terms, which should be checked before commercial use.",[105,108,111,114,117,119],{"path":106,"label":107},"\u002Fblog\u002Fidentify-phishing-message","Practice a pre-action message review",{"path":109,"label":110},"\u002Fblog\u002Finvoice-bank-change-scam","Rehearse supplier-change verification",{"path":112,"label":113},"\u002Fblog\u002Fdeepfake-payment-call","Test the trusted callback and deputy process",{"path":115,"label":116},"\u002Fblog\u002Fincident-response-small-business","Define incident contacts and authority",{"path":13,"label":118},"Review account-control responsibilities",{"path":14,"label":120},"Scope the supporting business-email work",[122],{"label":73,"url":74},{"title":124,"description":125,"button":126,"type":127},"Turn the exercise findings into owned technical work","Describe the email or account-control gaps found in your planning. Agree the work and responsibilities before any change or live simulation.","Discuss the supporting controls","check",[129,138,146,154],{"id":130,"path":131,"title":132,"description":133,"category":134,"artwork":135,"order":136,"publishedOn":137},"P094","\u002Fblog\u002Fvendor-access-review","Vendor access review for small business: verify the actual permissions","Review supplier accounts, roles, tokens, hosting and recovery access. Tie each permission to a task, owner, expiry decision and controlled acceptance check.","access","plan-plus",19,"2026-05-29",{"id":139,"path":140,"title":141,"description":142,"category":134,"artwork":143,"order":144,"publishedOn":145},"P116","\u002Fblog\u002Fphishing-link-clicked","Clicked a phishing link? Choose the response by what happened","Separate a link visit from password entry, MFA approval, app consent and software installation. Report clearly and choose account, device or payment response.","security",28,"2026-06-30",{"id":147,"path":148,"title":149,"description":150,"category":134,"artwork":151,"order":152,"publishedOn":153},"P120","\u002Fblog\u002Fremote-work-security","Remote work security for small business: protect the actual workflow","Plan remote access around the task, device, identity and permitted data. Separate VPN access from application authority and rehearse loss and offboarding.","websites",16,"2026-05-13",{"id":155,"path":112,"title":156,"description":157,"category":134,"artwork":158,"order":159,"publishedOn":160},"P087","Deepfake voice payment scam prevention for business teams","Verify urgent voice and video payment requests through trusted contacts and approval rules. Build a process that does not depend on spotting fake audio.","support",32,"2026-07-16",[],null,{"path":164,"label":165},"\u002Fresources","Website security resources and templates",{"path":167,"label":168},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058261]