Sustainable Phisheries: Preventing Disease in Farm Raised Phishing | Ean Meyer | WWHF San Diego 2022

## Overview Ian Meyer, Associate Director of Security Assurance at Marriott Vacations Worldwide and instructor at Full Sail University, discusses how to conduct phishing exercises in ways that preserve employee trust and organizational relationships rather than shaming users.

## The Fishing Metaphor and Core Problem Meyer frames the issue as a "fishing industrial complex" where security vendors make it easy to conduct massive phishing campaigns that shame users. Like industrial fishing with nets that devastates fish populations, poorly designed phishing exercises deplete organizational trust. Meyer emphasizes that while phishing is easy to execute (like casting a wide net), sustainable security requires treating employees as valuable resources, not targets.

## Key Technical and Ethical Points

**Bad Practices:** Meyer criticizes real examples where companies sent deceptive emails during the pandemic—GoDaddy teasing employees with fake holiday bonuses and Tribune Media offering false hardship assistance—to test if they'd click. These exercises violated psychological safety and used fear-based manipulation.

**The Scalpel Metaphor:** Meyer uses a surgical scalpel as a metaphor for offensive security tools. A surgeon uses it to heal; an amateur kills. Security teams must think about downstream consequences before deploying phishing tests.

**Building Better Pretexts:** Instead of fear-based messaging, Meyer demonstrates creating contextual, honest emails that match actual job duties. In a live audience example, he shows how shipping/logistics teams could receive emails about manifest updates (framed neutrally) and banking teams could receive customer inquiry emails—both based on real work patterns, not manipulation.

## Trust and Relationship Building

Meyer stresses that if security teams break trust through shame or punishment, employees stop reporting incidents. He shares a story of an employee who was fired after a social engineering exercise, despite leadership promising "nothing punitive." Result: help desk staff stopped talking to security, losing the organization's best source of threat intelligence.

Meyer demonstrates this through an audience participation exercise, throwing a trinket on a string into the crowd. When asked why the person opened the envelope, the answer was "trust"—the speaker wouldn't put something harmful in it. This trust is what security needs to build.

## Sustainable Security Program Model

Meyer advocates for: - Removing shame-based language ("you have been fished") - Using surveys asking *why* people clicked, not punishing them - Recognizing anyone can be fished under the right circumstances - Framing security team as enablers, not gatekeepers ("team of yes") - Making employees security champions through partnership, not enforcement - Focusing metrics on phishing *reporting* rates, not click rates

One of Meyer's exercises achieved 100% participation rate in a security champions program because employees felt respected and trusted.

## Actionable Takeaways

- Phishing exercises should emulate real threats but not use FUD (fear, uncertainty, doubt) - Write pretexts aligned with employees' actual job duties - Ask for help rather than testing obedience - Partner with business units to gather feedback on controls gaps - Meyer created a GitHub repository for crowd-sourced ethical phishing pretexts and landing pages - Success metrics should track reporting and security champion engagement, not shame-based click rates

## Philosophy Meyer concludes that security is about decreasing risk, not eliminating it. Businesses exist to take calculated risks. Security's job is to enable business while protecting against defined threats—this requires employee trust above all.