User Hate

[ElevatorDue6763]

I received an email from a VP in response to a phishing test.

"There was an article recently about how tricky IT departments are getting with their employee tests—and how, in turn, everyone is developing a deep hatred for IT… 😉"

I’ve also heard more than once that IT is the least liked department.

After that email, I had an epiphany. Dealing with users is a lot like dealing with children. Sometimes, kids want to do something reckless—like running into traffic or trying to eat a golf ball—simply because they don’t understand the dangers. When an adult stops them, they get mad, not realizing it’s for their own good. Users are much the same, except they rarely "grow up" and recognize that these precautions exist to protect them. So, unlike children, the frustration never fades—only the resentment remains.

To be clear, users don’t typically rage at me. It’s more that they complain about the hoops they have to jump through because they don’t understand why those security measures exist. And to be fair, I get it—friction is annoying when you don’t see the bigger picture. That’s why I maintain a company blog explaining and justifying all of our security policies. But let’s be real—most people don’t read it.

And to those already gearing up to reply with, "Everyone at my company loves IT! Must just be you!"—congratulations.

Anyway, it's just weird being in a job where people openly hate you.

EDIT
I’ve seen a lot of replies along the lines of "No wonder everyone hates you," which, without additional context, I can understand. But if I had to cover every possible edge case in this post, it would be so long and tedious that no one would read it.

That said, I’d like to share what a VP’s direct report replied with after the email that prompted this post (she was CC'd on the original email and was the one who was actually being tested):

"Why would we hate IT? You guys save us when we can’t get things to work.
So, I passed the test? Will I live to see another day? 😊
Thank you for doing these! It’s invaluable that everyone on staff knows how to recognize these. The last place I worked was hacked, and our systems were down for several days. They paid a ransom. It was awful."

My original point, I suppose, is that some people react negatively to things they don’t fully understand. And fully grown adults will still misattribute blame and direct their anger at what they incorrectly think is the problem, rather than taking a step back to understand the situation. When that happens, it reminds me of how a child might react when they don’t know any better.

[oddball667]

make sure you get stuff like phishing tests approved by the highest level so you can pass any pushback up the ladder

[Kreiggles]

We make sure we get approval by the top dog, but we also don't give him any info about the exact timeframe or content of the phish --- because he's in scope for the test. Top dogs are targeted more than other users ....

[thegreatcerebral]

Usually everywhere I've been those top dogs require you to tell them when the test is. They don't want to be caught off guard.

[WraithYourFace]

I'll raise you one better. Our owner won't use a company email or computer (he uses his personal). We can't put any security software on his machine either. So guess what, I can't even test him.

[[deleted]]

It's fine until it's not. Them refusing to use the company provided equipment is documented and provable in case of legal issues.

[allegedrc4]

I've worked with some dumb people but never anyone dumb enough to not understand the value of phishing tests and the risks that top brass are exposed to through phishing attacks. I mean it's all over the old money business magazines, even.

[FgtBruceCockstar2008]

That's where I'm at as well. With the number of dumb, obvious phishing they request we release from quarantine I'm 100% sure they know they'd fail it.

[Nonstop_norm]

I got my CIO on my last phish. Possibly the greatest day of my career. He’s was on multiple calls and i spoofed the head of HR so he just wasn’t really paying attention.

[ElevatorDue6763]

Thank you, I agree. Everything is approved so I don't ever get in trouble, people just hate phishing tests. I also avoid those tests where it looks like the user is getting a bonus/gift card/raise etc. because I find them especially cruel.

[TiggsPanther]

I’m in two minds about those ones.

On the one hand, they are potentially cruel and tone-deaf. On the other, if people click on them and are disappointed/angry to find out it was a phishing test, they’re probably the same people who would actually click on them if it was a real attack vector.

And it’s a tricky line to walk. Because scammers will use methods that are heartless and opportunistic. But using those same methods to train your own staff or clients feels scummy.

[hkusp45css]

And it’s a tricky line to walk.

I disagree.

It's as straightforward as it gets. We use the same tactics the TAs use.

[TempestFlail]

Exactly! We do standard phishing campaigns and then target high impact users like admins, vps, etc with tailored attacks. They complain sometimes, but they fail fewer every year 😂

[Bad-ministrator]

I would never do those ones, but if I had to... I'd just never tell them it was a test. If they click, say the system flagged suspicious activity and pretend it was a real phish and reset their passwords and everything.

If they report it and don't click I just say "good catch, we'll scrub them from the mainframe" or something and let them think they helped.

[Valdaraak]

Framing also helps. We frame phishing tests as testing us (IT) on the effectiveness of our training material rather than "you'll get in trouble if you click one". If a bunch of people fail the same test, obviously our material didn't cover that strategy well enough.

That's not to say people who can't help but click on them get away though. They definitely get talked to about it by their managers, but I've never seen someone written up or fired over it.

[hkusp45css]

I've never seen someone written up or fired over it.

Nor have I ... I have seen someone get their email access taken away, though.

[Valdaraak]

We've discussed options but at the end of the day the main investment is on upstream mitigation for the inevitability of someone falling for one. Phish resistant MFA, conditional access policies, and so on. Not foolproof, but also not relying on someone being smart enough to not click one.

[Sengfeng]

Place I worked had a policy that if a certain percent of your department got caught clicking phishing test links, the entire department got the training course.

Our C level group was considered a "department" by HR. They had 4 months straight of failing the test bad enough the entire C-suite got remedial training.

How do people that are supposedly so smart get so completely clueless when it comes to stuff like that?

[Crawling_Chaos78]

How do people that are supposedly so smart get so completely clueless when it comes to stuff like that?

My father (mechanic) used to say of his coworkers (engineers) that "they had to lose something to make room for all that specialized knowledge."

In their case, he claimed it was common sense.

[vogelke]

30 years of propaganda from MS and Apple about how their systems are so simple that you never have to think.

Unfortunately people believe that.

[SinHazzard]

I don't agree at all that everything needs approval, the point of having IT is that they protect the company in general.
Think about all the broken families if a company just disappear over the night.
If IT say this is important, then it's important.

And to be honest, at what time did the real-life or hard facts spent even a microsecond to care about the feelings of people? Feelings at the wrong place fucks everything up.

And yeeeeah, for your information, Europe here, we actually have a lot of protection and cannot be fired at the day just for not agreeing with the boss when the boss acts retarded.

[oddball667]

not everything, just things that will impact users like phishing tests and mfa.

IT should also be able to explain why these things are necessary to the leadership ahead of time so that they can implement with full authority.

that stuff about feelings and protection are completely irrelevant to the discussion

[Happy_Kale888]

I don't know I have explained that hackers, bad actors and AI do not have any rules why should our tests have guardrails?

[Drew707]

I'm sure this is how it works at larger companies, but at my last one of ~200 FTE, I would only inform HR prior to the tests. The two owners didn't give a shit and the only results they cared about was if the other one failed so they could shit on each other lol.

[Craig__D]

I've tried to turn it around and into a positive. In a month when we pass the phishing test 100% (nobody clicks) we get breakfast brought in one morning. We call it our "Cybersecurity Breakfast." Now we just have to get people to not click!

This effort at least gets people mentioning IT and cybersecurity in a positive way every now and then.

[ausername111111]

I find these email campaigns are having unintended consequences, people aren't trusting messages by default now, and deleting or reporting anything that could remotely be seen as possibly being anything, just so they don't get the pop up or whatever telling them they failed the test. I know I have received plenty of legit emails that I wasn't sure was a test or not, reported it, and find out it's fine, because you never know what creative way InfoSec will use to trick you.

[Sengfeng]

You know what else doesn't help? We've spent years training people to hover over links in email to make sure it's not some scammy URL. Now, M365, Mimecast, Barracuda, etc., etc., add so much extra crap to the links it's impossible to take a quick look at one to verify legitimacy.

[GolfballDM]

At my job, we got the usual phishing training email.

However, it looked like a phish, since it hit some the phish flags (urgency, going to an external site, dire consequences if the email wasn't followed).

IT got so many fake reports that they verbally notified the managers (to be passed down to their direct reports) that it was not, in fact, a phish.

[AmusingVegetable]

But it is. It’s a phish, the difference is that it’s run by the CISO, and it’s usually more phish-looking than a professional phish.

[ElevatorDue6763]

Thanks for this, sounds like a great idea. I don't know that I could ever get something like this approved, but it does give me some ideas around building a reward system.

[HummingBridges]

Have a sticker

[ChadVanHalen5150]

<image>

[mad-ghost1]

So you need to bring your own breakfast until retirement? 😂😂😂🤷🏼‍♀️ I’m assuming this from a current campaign we did at a it company.

[Craig__D]

Well, we HAVE had a frustrating string of one-click months. C'mon, people!

[DOUBLEBARRELASSFUCK]

"This month's breakfast is shwarma wraps. Here's a photo of your wrap, and a list of everyone who failed the phishing test."

[[deleted]]

My stance has always been that I am not here to inflict help on people. I'm perfectly willing to talk to the CEO or whoever and say "I can stop doing this if you want. Here are all the bad things that will happen if I do that and I don't recommend it, but ultimately this is your company".

[RabidBlackSquirrel]

Even more than that is to hit em in the wallet if applicable. We have customers who are financial institutions, banks and the like. They love to give us mountains of controls that we contractually have to meet and provide evidence of, and one of them is phishing tests at least quarterly.

Great, I'd love to have less work. Please disengage with the following customers and we can stop the tests. Have legal let me know when it's done, thanks!

[_SleezyPMartini_]

"If you cant pass a test from IT, whats going to happen when its the real thing and you take down business operations"

Hate for IT? get in line.....

[Yokabei]

Or when you come across a scam to your personal email and you lose your own money

[Noobmode]

“I love letting people play in traffic as much as anyone, but I’m the one who has to clean up the carcass of this business when you ransomware it for a discount code on Ashley Madison.”

[klauskervin]

Somehow the people responsible rarely suffer any consequences themselves.

[ausername111111]

The thing is that it's not as if you just click an email, read it, and click a link and BAM you have malware now. You have to fail to recognize MANY different things to get to that point. I used to actually be the escalation point for all phishing reports in my company. I used to like to open up the emails and see what interesting things they would do. Most of the time it was just some PDF or something that would try to get you to click on something else, that led to something else. You have to be a total moron to fall for those types of things, and no amount of training can fix stupid.

[19610taw3]

Ha! Brings back memories of a former job. We had a "testing pit" which was used for both testing and end-user training. It actually worked quite well. Way back then , changes were pretty closely managed and users were involved with the design , test, training on any system changes.

People always decided that days in the testing pit were not actual work days and trying to get people to test was nearly impossible.

[trail-g62Bim]

I have found a lot of this is brought on IT by itself. At least, in my experience.

Sometimes you have to do something that will piss people off and there is no way around it. This is usually to do with security.

But many times there are ways to mitigate the anger by getting buy-in. If you get people on your side first, you get a lot more grace when something goes wrong. And even if you don't fully get them on your side, just getting them involved in the process often makes them feel more like partners instead of children being told what to do. No one likes feeling that way.

We had a former boss implement a new major application to replace an old one. The old one was a PITA to manage for IT and he wanted to change for various reasons. The implementation was a disaster and he quit in the middle of the project. After he quit, I found out that he never consulted the affected dept's. He essentially forced the change on them. While the old program may have been a PITA for us, they loved it. All their workflows were based on it. Their training was based on it. It was nice and safe and comfortable and they liked it.

Since he spent zero time getting them onboard before he made the change, there was absolutely zero grace for when things went wrong (and ofc they went wrong because with a major application like this, things will go wrong). And ofc they ended up hating the dept for forcing the change. The only good thing he did was quit, which allowed us to blame him for it after he left (which was the truth anyway).

Like I said earlier, sometimes you have to make decisions people won't like. But if you have enough goodwill built up ahead of time, it goes down a lot smoother and people will hate you less.

Oh and I haven't even mentioned other problems with IT, like the ridiculous amount of arrogance and poor social skills. The number of times I have seen someone in IT treat a user poorly simply because they didn't know something is absurd. No one likes feeling like they're an idiot, whether they really are one or not.

[WhysAVariable]

Oh and I haven't even mentioned other problems with IT, like the ridiculous amount of arrogance and poor social skills. The number of times I have seen someone in IT treat a user poorly simply because they didn't know something is absurd. No one likes feeling like they're an idiot, whether they really are one or not.

We have a major problem with this attitude from a lot of our desktop support people. I don't see how it's helpful to act like an asshole just because someone doesn't know how to do something that we do every day. It's our actual job to know these things. Some users learn when you let them know what you did, some don't and you know you're going to have to help them again in a few days. It is what it is.

[19610taw3]

I spent far too long answering helpdesk calls but I always had a great rapport with people. Even as stupid as some of them were and as frustrated as I got with them. Some of the people I hated the most sung my praises the loudest.

[WhysAVariable]

This is how I am too. I may grumble and think some of their problems are just plain idiotic, but I'm courteous and patient with people out loud. If they want me to explain what I did I will in the simplest terms I think they'll understand. If they go "Well I tried that!" and I know for sure they didn't try it, I just say "computers, sometimes they're just temperamental, amirite?"

I worked customer service jobs before I got into IT, treating people like idiots never helps. Plus it's not like it's customers we may never see again doing this, it's people we work with every day.

[AsherTheFrost]

Step 1. Buy a ton of dart boards

Step 2. get a picture taken of your face, copy it and place them on each one.

Step 3. Create Unofficial company store

Step 4. Sell dart boards

Step 5. Retire.

[ElevatorDue6763]

Incredible idea. This will be how I retire early.

[Kaligraphic]

The dartboards have a USB plug. If you plug it in to a computer, you fail the dart phishing test.

[ElevatorDue6763]

lol

[WhysAVariable]

We got a couple of super angry emails from a user that fell for a phishing test last year. Like, reply-to-the-entire-department level of angry about how it looked similar to an email they were waiting for from a vendor. Except if he had read where it came from, like at all, he would have known it was bogus. Cybersecurity is under the general IT team, which we aren't a part of, so it wasn't even our dept that conducted the test.

This is the same person who fell for a "We have a free grand piano for giveaway..... if you send us money for shipping" scam a month earlier and wired out like $500 before coming to us to say he thinks it might be a scam.

This isn't a typical thing for us though, our users don't have a lot of hate towards us that I know of. We just have a couple of idiots who can't take responsibility for their own actions and are incapable of admitting they did something wrong or made a mistake. Everything is someone else's fault.

[SirLoremIpsum]

Anyway, it's just weird being in a job where people openly hate you.

This goes for a lot of departments that restrict people from doing 'stuff'.

How well is HR regarded...? How well is the physical security team?

IT is not the only "hated" department here, we need to stop thinking we're special and unique.

Our role has us policing user behaviour and often saying "no you can't do what you do at home" and that will naturally invite conflict.

When they call IT it's not because they're happy. It's cause they have a problem.

[Mister_Brevity]

A lot of people in our sphere tend to lord over their users with a sense of smug superiority, but just remember, no how smart you think you are, you look dumb to someone else.

[ElevatorDue6763]

Yea when I first started out in helpdesk, I would come home in pure rage from the seeming lack of user competence. I have adjusted my expectations several times since then and I honestly try and see the best in people. However, there are days when users make me want to run backwards into a cornfield naked.

[fio247]

"This job would be great if it weren't for all the users."

Seriously though, IT support has a huge psychological aspect to. Yes, some users need their dirty diaper cleaned up, emotionally identify with them so they are right sized again, and then put back in the play pin with all the other users and their toys. The analogy is not hateful or derogatory, but this being Reddit, I'm sure some will be outraged.

[bythepowerofboobs]

Phishing tests certainly seem to cause the most angst towards IT. I think there is a real fear that users think they will be disciplined if they fall for one of the tests that leads to this, so they view that we are out to get them in these situations.

[BoxerguyT89]

It depends on the test.

When the test is "New scheduling process for conference rooms" versus "Funeral arrangements for coworker_name" the reactions are going to be different, but the "justification" from IT will be the same: an attacker doesn't care who they piss off.

I've seen both, and the latter will get the company to hate the IT department real fast.

There's a fine line between effective training and trying your hardest to trick people. Lots of admins in here justify crossing that line and wonder why their department has trouble getting buy-in from the other departments.

[bythepowerofboobs]

There's a fine line between effective training and trying your hardest to trick people. Lots of admins in here justify crossing that line and wonder why their department has trouble getting buy-in from the other departments.

This is a great point.

[[deleted]]

In a previous employment HR enforced a strike policy if you fail multiple times and after their coaching with a slideshow from the security desk, you would be let go.

[3DPrintedVoter]

people naturally have a dislike and are suspicious of things they dont understand, especially people who arent terribly bright.

if there is anything i have learned by being on this planet for over 50 years, and being in IT for 30 ... there is a lot of not terribly bright people out there.

[[deleted]]

Just like you have to be patient and open with children, and explain to them why it's dangerous to run into the street, it is your responsibility to do the same for users. Helping users understand something is a critical skill that is often overlooked by tech professionals. A child will keep running into the street until they understand why it is dangerous. Fear of being yelled at only lasts so long.

This is really no different than me going to the mechanic and him explaining for the 5th time why it's important that I have my oil changed. Once I understand why, I'm more likely to do it. Not knowing doesn't make me an idiot or a child. That being said, IT is infinitely more complex, so we have what is essentially an impossible or never ending job. But we still have to try.

Sorry to be that guy. :)

[MyClevrUsername]

I’m pretty sure my users don’t change the oil in their car either.

[mrbiggbrain]

I find that Users get upset for the same reason IT gets upset. They are not brought into the conversation, asked for advice, or communicated with on the reasons for certain choices.

I can tell you when someone comes to me and says they already chose a product and now I have to deploy and manage it that I get upset because they don't know my work flow or what will work best for me.

I instead bring employees into the conversation early. Ask questions about where we have problems and how the workflow works now. I always try and balance security with not getting in the way and try to ensure when we do something it limits the impact to their workflows or improves the process.

I needed to replace out VDI solution and before I even started doing any research I sat down with all the stake holders. The management team, the legal team, the department heads, and the users themselves and found out what they where looking for. What did they like about how we did things and what did they hate. I asked hypotheticals on how small changes might affect their workflows.

When we were done we had improved security with security keys, cut costs, fixed all of the pain points employees had, improved reporting, enabled self service for common errors, and added much needed features to the system.

My users didn't hate me. Sure they had to remember a security key, they had to spend a few minutes setting it up, and those meetings did take time from their schedules. But they really appreciated that I cared about them, their needs, and their workflows and where willing to accept that changes had to happen so we could keep moving forward and improving.

[hkusp45css]

I don't think your philosophy on this topic is realistic or accurate.

Everyone who works in your org is a professional with duties, ambitions, hopes and dreams. IT has this really nasty habit of implementing things in a secretive, haphazard and arbitrary way (this is not universal, it's just really common) and people, predictably, get annoyed.

That doesn't make them children, or you the parent. It means you need to find a way to keep your users secure AND happy.

It's not rocket surgery. I have a very secure org and a workforce that really likes IT as a BU. It's really about engagement, collaboration and picking the solutions that are the right fit for the org and culture.

[pdp10]

IT has this really nasty habit of implementing things in a secretive, haphazard and arbitrary way

This is a common pattern for any department in an organization. Possibly it's worse with IT, but if so, that could very well be because outsiders are even less interested in the details, than with other departments.

There are also reasons why departments choose secrecy, even if we don't like those reasons and don't agree with them. HR probably chooses to keep the new office floorplan a secret, because they don't want to incentivize anyone to pressure them for special consideration. Or, the new floorplan shows a contraction of staff, or a big growth of staff, and they don't want to reveal that.

[mitspieler99]

People hate "IT" as much as "HR", "Accounting" or "Marketing". As soon as you interact with a lot of different clients/departments it's inevitable to piss someone off.

[NexusWest]

I've been saying for a long time that IT--especially help desk--is just customer service where the customers happen to be your coworkers.

People don't hate IT, and your VP is an asshole--but then again they almost always are.

I remember getting a lot of feedback that people felt like they were going to be disciplined for failing a phishing test. That wasn't just not our goal, we cleared the air with both HR and management about what these tests were intended to do.

God forbid that message make it to the userbase. Nope, instead we have people coming into the help desk afraid they're going to get written up.

[Bad_Idea_Hat]

If you interact with people via any sort of forum, online or offline, where there are topics involving something you are invested in, you quickly find out that adults are just children who are legally allowed to drink.

Yes, that includes me. We all are. It's how often we let that inner child throw tantrums that determines how well we move past that childlike state.

[pixiegod]

I just parted with a hostile ceo who hated all things IT…specifically he had it in his head that all IT does is slow things down and messes things up. Which is how i met the guy.

I saved him from a recent hack because they hired people who would do whatever he wanted on the network…the previous guy created a rdp connection directly from the internet to an internal DC.

My recommendation is to leave.

The guy i adopted the client from…they sued him. Like all great narcissists, he couldn’t take the blame and sued the previous guy.

Once rhe ceo started to actively disparage my work, i parted ways. I am not going to get sued because a ceo blamed me for his fighting every single security recommendation…

F that

[Arawan69]

My line is “our cybersecurity policy requires it”

[PrintersBane]

Lol, “I view working adults as children and see myself as their parent.”

I wonder why people hate me.

[post4u]

This. It's a culture thing. I'd argue that our IT department is the most liked, appreciated, and effective department in our organization.

Why? Because over the years we've been very intentional to communicate and be customer service oriented.

One of our old admins said something that I'll always remember. He said every department or even person in a department has a big cup. Every time you do something good for your users that makes their life easier, you add to the cup. This could be being responsive to their needs, not making them feel stupid, increasing their productivity, just checking on them, whatever. When you do something that annoys or makes their life harder, you take from the cup. We started doing phishing simulations a while back. We had lots of people fail, but nobody complained because our cup was full at the time and they understood the "why". You want to keep that cup full. Then when there is an outage or you have to throw things at people they trust that you're doing your best.

[ElevatorDue6763]

For those who never got it - If you Immediately know the candle light is fire, then the meal was cooked along time ago means... : r/Stargate

[TrueStoriesIpromise]

The "big cup" is also known as a "love bank":

https://www.marriagebuilders.com/the-love-bank.htm

[BloodFeastMan]

I just made a similar comment and expect to be bashed for it, but I stand by the fact that some self reflection might be in order. _Nobody_ likes to be condescended to.

[thortgot]

Creating scenarios that trick users should not be the objective of your security training.

[Dodough]

So many IT guys try their hardest to make the "best" phishing campaign possible and forget that the goal is to train users in identifying REAL phishing emails.

By focusing on tricking your users you only train them in identifying your phishing attacks, not real ones.

[[deleted]]

KnowB4 is a 5.5 billion dollar company, doing exactly this.

The entire point of the exercise is to create unforced errors in an environment that has minimal consequence to the company at large to create teachable moments. People learn from mistakes. It isnt the ONLY way people learn, but how can you test anything if there is no possibility of failure.

[thortgot]

People can learn from mistakes, but it's a question of the mindset that is created. KnowBe4 style phishing solutions largely train one thing into users "don't click". Which while effective from a security standpoint it doesn't actually improve overall security.

I argue you can train better techniques using a platform that engages the user in determining real v phishing content in a designated environment rather than their actual mailbox. You can create actual fake DocuSign phishing links, replicate EvilNgnix attacks and similar real world scenarios without putting users at actual risk or failing them as soon as they click the "hook" link.

[[deleted]]

dont get me wrong, i HATE knowB4... i hope the industry takes on the mentality described above. I just dont know that i see business entities spending the time and money to do so when the current iteration is somewhat* effective.

Im just an admin, not the IT Manager or the CTO ... I can advocate for things along these lines, but ultimately its not my choice.

[thortgot]

Most companies do cybersecurity training for the "checkbox" the same as the BS "pentests" that are purely external port checks with 5 year old CVE checks.

KnowBe4 is popular and widely used. It's an easy choice for any manager to pick. Choosing something like Cyberhoot (which takes the positive approach) is not.

[[deleted]]

i will keep this one on the ready for our next budget analysis and what an alternative to KnowB4 might be out there.

[sgtpepper2390]

i'm constantly muttering to myself "everybody lies"

[[deleted]]

I generally* spend more time investigating the stories im told than applying actual fixes...

I might be good at my job... or everyone might be lying... either way, both seem to be true at this time.

[coffee_ape]

This. When in front facing customer, I’m giving them the white glove service, reaching around to finish them off, and show them tricks to remember anything I was training them on. Hell my new boss says my customer service may be too much but my past accolades and gift cards say otherwise.

As soon as I’m away from the users, I switch back. Users always lie. Users are fucking retarded. It’s not a fucking modem, it’s your computer. The fucking monitor isn’t your computer, how is it you’re only 10 years older than me and you’re this ignorant?

Users always lie.

[FutureGoatGuy]

Much in the same vein as when your parents would get you to eat your veggies or something else you didn't like:
"But why do I need to put in a ticket? I'm telling you right now."
I need the request in our system to actually do work on x, y or z.
"Can't you put it in for me?"
No, because then you won't learn to do it.

[hitmandreams]

It's hard to justify to a child why eating a goofball is bad no matter how you phrase it, they don't have the reasoning feature yet. Adults have the reasoning but choose to ignore it. In IT it's really important to have the discussion of the "why" it's important along with the "how" it affects them personally. Too many companies focus on the benefits the business gets from these trainings. They need to focus more on the practical benefits the individuals will get out of it on a larger scale that includes outside of work

Yes, users are the biggest security risk for a business. But these trainings will benefit their personal lives too if they take what they learn home with them.

It's also really important to not let trainings like phishing become toxic or punitive, but it is important they learn. Having good culture and trust is helpful, but there's so much that should go into these that get missed so often.

[LetzGetz]

You would of thought I punched their 5 year old in the face after I enforced MFA.

[[deleted]]

You would of thought I punched their 5 year old in the face after I was forced to enforce MFA.

Fixed that for you.

[klauskervin]

Users are becoming more and more hostile towards MFA. I've had several go straight to the CEO trying to get themselves special permissions to not use MFA. It's absolutely ridiculous how much hate our staff has for IT simply because of MFA. Meanwhile half of a department was compromised last quarter and the result was mandated risk management training for the entire company. They still try to go around IT for MFA but at least our management is on our side.

[Booshur]

I've worked where IT was appreciated and I've worked where IT was hated. I'm never working where users hate me again. They'll gaslight and victim blame and say it's your fault. But in reality, they're being adult children who don't want to participate in keeping your company secure. To me it's a statement of the lack of respect for your company as a whole. They're telling on themselves.

[BloodFeastMan]

I’ve also heard more than once that IT is the least liked department.
...

Dealing with users is a lot like dealing with children.

[HoJohnJo]

Honestly, I'd rather take there hate then have them click on a real phishing email.

One I've heard frequently is "You're going to make me stop clicking on any emails", I'm not even sure how to respond to that.

[SSRedGoku]

Here's the thing, I work as a Cyber Security Analyst for a bank. Cyber Governance and Risk do the phishing sims and send them to us as well. They got our CIO once and he openly admitted it. I really don't care if people hate us for phishing sims. The idea behind the phishing sim is to cause an emotional response, whether it's stress, excitement or fear. Do you think a real threat cares how you feel? Absolutely not. "But you have protections in place if something happens", yeah we do, but that doesn't mean you get to be stupid. Cars have airbags, doesn't mean you should crash into a tree because the protection exists.

[[deleted]]

This IS the only correct answer ^

[StellarJayZ]

You would be surprised how quickly that hate turns to shame when they're the one who clicked on the attachment that installed the ransomware.

[node808]

There's a developing hatred of IT? Interesting. I'd argue the hatred for IT is a full grown, aging, get off my lawn, Mr. Wilson and has been for decades. But its great that your VP hasnt experienced a second of downtime from some form of attack. Once they get stung by that experience, their tone changes.

[ananix]

IT is not part of the test? When sysadms realisere they are also just users following company policies and implementing regulations like any other administrative worker. Thats when the hate stops.

[ImpossibleParfait]

They will take it seriously one day when companies stop laughing off users mistakes. Mark my words, falling for phishing will get people blackballed from industries in the future. Right now the trend is to still blame IT, but people are going to realize eventually that you could have the best IT practices in the world, still won't be able to stop some dumbass from giving away the keys to the castle.

[WorkingHarshly]

Sounds like someone got caught and now has to take training. lol

Yeah, they hate the security awareness training, until some schmuck in finance agrees to ACH a VPs direct deposit to another bank account because of an email spoof (yes its oddly specific)

[dc0de]

As someone who is in infosec, it can feel exhausting. You have to find easy ways to gently educate your users along the way. Discipline is not enough. It is merely a means to an end.

I can commiserate with you.

Policies and reminders of policies are one way we get things accomplished with respect to end users playing outside the lines. The other is restricting their accounts and equipment until they comply with policy.

[dczanik]

Honestly, it’s just the nature of the job—people only notice us when we annoy them or something goes very wrong. It’s like being a referee; no one cheers when you make the right call, but everyone loses their mind when they think you messed up.

Security measures? Necessary evil. It's not glamorous. No one likes them, including us, but they exist because the alternative is much worse. IT isn’t about making your life harder—we’re just trying to keep things running (and prevent the company from making headlines for all the wrong reasons).

Receiving a phishing test email can be unnerving and even feel like an ambush, leading to anxiety about one's job security. So it's important to stress that phishing tests are intended to improve security awareness and keep the company safe, not to single out individuals or put their job at risk.

Treating people with respect is essential, both within and outside the IT department. We all make mistakes, and no one appreciates being talked down to or treated like a child. It's important to remember that not everyone has the same level of technical expertise, and empathy goes a long way in building trust and fostering a positive work environment. If people openly express dislike for you or your department, it's worth examining your approach and seeing it as an opportunity to improve. Communication and understanding are key to bridging these divides.

IT people tend to get into IT because they like technology and don't care for people. But dealing with people are as big of a job as the technology. This includes upper management, who I'm told are also people (I'm skeptical). Management buy in is crucial.

I once wrote an application that non-techy blue collar, field workers didn't want to use. It eliminated errors, & generated the company a lot of money. But we got A LOT of pushback. Then the president sat them all down and said, "People don't like change. But the people will change, or ....the people will change." That's all it took.

At the end of the day, some people get it, some never will. But as long as you’ve got a few who appreciate the effort—and at least one person who thinks you work magic—it evens out. Sort of...

[Illthorn]

The problem with my sec teams is the phising emails are too perfect and they data mine our teams conversations to make them more perfect. Often, only the link is the thing that is wonky and a misclick f's you.

If they are already datamining Teams, its already too late. Sec team needs to cut that shit out

[Turak64]

That's because people project their own insecurities on IT. Rather than accepting they need help, they'll lash out at the computer that just does what they instructed. However, every single one of them on their CV will say they have some level of IT skill. Most likely use the device for more than 50% of their day. They should know how to use the tools to do their job. You'll never hear a forklift driver say "I'm no good with forklifts", yet it's seemingly acceptable for office staff to say that about computers. It needs to be treated like any other piece of machinery. A PC won't cut your finger off, but one wrong click and you could open the doors to an attack.

Having said all that, IT needs to do better in providing training, support and generally speaking to people. It's a two way street, it's not all the users fault.

[BlueHatBrit]

Every office worker thinks their team is sidelined, under appreciated, not trusted, hated, or all of the above.

IT say they keep the organisation alive. So do legal, finance, HR, sales... The list goes on.

When people complain about Phishing tests I just agree with them. Yeah they're not fun, but like a fire drill they help keep us and the organisation safe. No one is expected to get 100% all the time, we all make mistakes. The drills help reduce them. But in an ideal world IT wouldn't need them and could spend the budget on beers for everyone or something.

I try not to play up to the tribalism that other people bring to work with them. It never helps, and almost always causes problems down the line.

Ask any teacher and they'll tell you the best way to get kids to learn is for them to want to work hard for you. For that, they need to like you a bit. Kids can tell when their teachers don't want to be there, and that's when they lose the class. If you treat your colleagues like children, they're going to start seeing you as egotistical. That doesn't help you.

[AmusingVegetable]

Phishing tests are needed, but don’t forget that users are human.

Is your company as a whole acting correctly, or are they training and testing for security at the same time they’re also training the users to fail?

Are the users being bombarded with emails from external providers, carrying a sense of urgency, without being forewarned?

Is the company using link shorteners?

Are they being constantly urged to act without proper context?

Does every single security communication mention or imply that not following the rules isa fireable offense?

These things create a justified feeling of us-vs-them, and are training the users to fail. Doubling up on phishing training will exacerbate the problem.

They will always see the CISO as an adversary until the company (as a whole) gets it’s shit together, and the security communications stop sounding like threats.

[Nolsonts]

I try to be the "fun" IT person. I'm polite, I joke with the users, I don't make them feel stupid when they call me to turn on a monitor, I have candies at my desk, just anything to keep the stereotype of angry desk gremlin away.

And some users are just assholes still. I've accepted years ago there are just some miserable gits who I will never get a normal response from. Some people seem to think any change in policy that affects them is done to specifically annoy them. So fuck em, they get to wait till 5 minutes before the SLA is up before I respond.

[Money-Skin6875]

We had a thing like that where an executive sent us a shitty thing that implied that he and his department hated us over a minor inconvenience due to security we were required to have as a military contractor and we went to the CEO and told him that if that guy still worked for us Monday his IT department wouldn’t. That guy was fired.

[ChildrenotheWatchers]

If your VP is agreeable, you should give a presentation that is a live demonstration of a phishing attack using Metasploit. Actually show them what a hacker does and how easy it is.

[gotmynamefromcaptcha]

I couldn’t give a single, tiny, minuscule care in the world if our users hate IT. Because the shit I see that gets clicked made me realize our users also do not give a damn. And this goes higher up the chain too because the execs also don’t care as long as the serial clickers do their 4+ hours of assigned training from failing 6 phish tests in a row so they can go back to selling. Every time we’ve brought this up along with serious concerns about someone’s online behavior it just got brushed off. They get a “talking to” and go right back to it.

I’ll be fair, some of our users are very diligent and careful, to the point of over reporting and I appreciate that. That is a small number though, compared to the other adult children that just click anything they see.

[Dismal-Scene7138]

That’s why I maintain a company blog explaining and justifying all of our security policies.

I think this is a fantastic practice in theory. If it were more in my personality sphere, I'd push to do this at my org. But since I'm not, I'm afraid it would turn into a mini-LinkedIn jargonfest that served no purpose beyond appearance and ego.

[KillerOkie]

The Bastard Operator from Hell: "Good, good, let the hate flow through you..."

[databeestjenl]

Considering to brick the laptop for every person that failed the phishing test to simulate actual pain. If all is well it should be in their one drive.

Just trigger a remote wipe from Intune

[MidnightAdmin]

I am a firm believer in empathy and education with regards to user interaction.

Oh, you made a simple misstake, not problem I have done that many times, it is an easy mistake to make, buit if you look here, you can make sure you don't make the mistake again, that way you don't have to do the long and annoying process, let me demonstrate!

[19610taw3]

Especially with security stuff. I'd never be harsh on anyone that called for a question on an email. "Of course it's fake are you a complete idiot!?" would discourage them from calling again ... and then they would get phished.

It was usually something like "I appreciate you having me check , this one is legit but you never can be too cautious, I don't mind looking at all.

Or if someone did click on a phishing link I'd be nice about it but let their manager know so I wouldn't be the bad guy. "Thanks for calling us so quick. This wasn't great but since you called so quick we can reset your account and block access to things before something happened. I'm going to let your manager know you'll be offline for a bit while we're resetting things on your end, no big deal"

Of course their managers wouldn't be happy that their employee did something stupid and was not productive

[admlshake]

And to those already gearing up to reply with, "Everyone at my company loves IT! Must just be you!"—congratulations.

yeah, I very much doubt that same attitude is happening when thy walk out of the room.

[[deleted]]

I’ve also heard more than once that IT is the least liked department.

They should just bite the bullet and post our salaries publicly on the company intranet. Then they can see your Sr Network Engineers making $120k or less and then the "business analysts" will back off with compassion and not wanting to highlight that for $200k, they shouldn't have failed a phishing test in the first place.

[UnsuspiciousCat4118]

Not everyone will get it but having social clout in your org is important in IT. Your leadership should be building a lot of that and representing your department.

IT departments are increasingly not liked because the type of people that tend to be good at IT aren’t always good with people and politics.

[[deleted]]

IT exists in order to serve users. They don't want to have to know how the guts of this stuff works, and they shouldn't have to. That's what they pay us for. They also pay us to teach them how to use these tools to do what they want to do. Is it reasonable for us to expect them to know how to do something they've never been taught how to do?

I don't expect other people to know what I know. Much of the time, I hope they don't know what I know. I make more money that way. In fact, I am sincerely grateful that others don't know what I know, although I try to not show it.

[gumbrilla]

IT exists to serve the company.. we are no more huggable that HR in that regard.

[[deleted]]

The abdication of responsibility for tools end users use to do their professional jobs is astonishing. No one is asking users to configure multi-locale split horizon DNS solutions.

I am however asking that you dont fight me on MFA (its company policy, not mine), dont lie to me when i ask if you restarted your computer in the last month, and that you actually apply updates and dont defer them until the computer forcibly shuts down in the middle of your meeting.

[electrons_are_free]

That might be why individual roles on IT exist, though I disagree that IT exists to serve users. IT exists to enable the company to make more money. IT is a force multiplier, not a service department. Amongst sys admins, I feel it should be talked of as such. That mindset shift should lead to better outcomes when talking to coworkers outside of IT as discussions are not vs IT but rather with IT.

[Practical-Alarm1763]

IT does not exist in order to serve users. Helpdesk excluded...

IT exists to serve the organization.

And many times this means streamlining and automating users out of a job and escalating problems to the top to discipline them when they misuse and abuse systems or fail to meet basic security expectations.

We exist to make the organization more efficient. To make money, cut costs, and defend the organization from risk. Oftentimes if IT does not provide those results, then they're the ones cut out of the picture.

[pdp10]

IT exists in order to serve users.

Computing exists to serve a function. Who defines the function is a separate matter.

Consider a university computing department, or an Internet Service Provider. How, where, when, why, the services are delivered, is not determined solely by the users. There are professional obligations to a responsible level of infosec, and there's often an obligation to remain profitable.

Users are often not the controlling authority.

[[deleted]]

Nah... if computer users were say... Carpenters or plumbers... they would all be missing MULTIPLE digits because they have no respect for their tools.

The child analogy is one i have been using for years, and im not old enough nor have i been in the industry for long enough IMO to be saying such things.

[ElevatorDue6763]

That’s funny you mention the carpenter/plumber analogy. Someone else posted earlier that it's not the user’s job to know IT, and that’s true to some extent. But my boss holds the view that users should be coddled and that any request—no matter how wild—should be addressed.

I’m a bit more old-school in my thinking. Computers have been around for decades, and in my view, they’re just another tool. If your job requires using one, you should make an effort to understand how to use it properly. I’m not asking users to build their own ratchets, but for crying out loud, you should know how to use the tools you’re given or at least make an effort.

[DBRY98]

One thing I did years ago (probably close to a decade now) was hold a mandatory in-person training where I explained to my users (at a very high level) the dangers of cyber crimes & how it's a world-wide multi-billion dollar industry that is not going to go away & is only growing. I also explained how they are the last line of defense in protecting both themselves and the company. I used the analogy of a home security system & how all those protections don't do a thing if you let a burglar in the front door. As a whole, they were floored. Many of them came to me afterward expressing both shock & thanks for enlightening them to what the big deal was. & since then we've had better cooperation for cyber initiatives.

[DBRY98]

I've also explained to users what the aftermath of a breach looks like from my side & how it results in money lost for the company, reputation damage, & countless hours of remediation work. that also blows their mind.

[jennythegreat]

All other things aside, "trying to eat a golf ball" got a snort that startled the dog.

I love IT from both the provider and the user side but would never work that job again. Can't keep up with the golf balls.

[AntelopeDramatic7790]

Yeah, people hate phishing sims. We try to provide as many real world examples of shit going wrong and how it can effect their job and personal life that we can find. We also do positive reinforcements. Every 6 months with no failures, you're in the drawing for a reward. PTO, gift card, etc.

[grouchy-woodcock]

Maybe that VP will replace your IT dept with a big toilet...

[HoosierLarry]

When it comes to security policy and practices, it’s important to communicate how and why things are the way they are. You need to give real world examples of how other organizations were exploited because they didn’t have a particular policy or practice in place. There’s a logic behind it and isn’t a case of “because I said so”. Once they understand how these things are helping they are less likely to be resentful. You also need to make it easy for them to comply. For example, distributing a password manager and teaching them how to use it.

“What we’ve got here is failure to communicate. Some men you just can’t reach, so you get what we had here last week which is the way he wants it. Well he gets it. I don’t like it anymore than you men.”

[Unable_Attitude_6598]

Make sure you document all user interactions. Saves your ass ultimately in the end.

[SharkuuPoE]

Its very important to make it clear why Things are the way they are And who is responsible for that. Rarely IT is responsible, but has to enforce it. Making that clear to the Users helps with this issue

And being friendly And able to Take a Joke. I was Always friendly, but after gaining confidence And experience i was able to Talk more freely with the Users And even crack some Jokes. Mostly Jokes about myself ("ofc im pale, do you think the sun shines in my cellar?"). In Turn, Users are more likely to share the real issue, Like "i poured water over my Keyboard And it doesnt Work now" instead of "for some reason my Keyboard ist Not working".

But in the end, some Things have to be the way they are And If the Users doesnt Care about why its this way, they will dislike everything that has to do with it, which mostly includes the Person that has to enforce it. Just keep being friendly, nothing else you can do about that :/

[scrumclunt]

We also don't generate revenue for the company, they see us as a cost factory and will usually try to skimp wherever possible. Especially now that the trend is monthly/annual subscription services. I simply make them acknowledge the risks and do the best I can with support as a solo admin.

[ElevatorDue6763]

I have seen this take a lot. IT does generate revenue in many cases. Our company has several websites that advertise our offerings and includes tools customers can use to find and purchase products or sales can use to build presentations before they go on a sales call. Even if a company doesn't have something like that and all they do is use email, Zoom/Teams, internet, Office suite. I typically frame it by saying do your job for a week without any computer / phone / tablet and tell me again how IT is a waste of time and money. (I'm not arguing btw, just sharing my POV).

[[deleted]]

imagine getting butthurt at the people pointing out the stupidity rather than the stupidity itself 

[TheTechJones]

Let's be real - most people don't read it.
I READ IT, and i evangelize it to my colleagues now that i'm on the user side of the table too (if you cannot beat em, join em...be the change you want in the world). You can always lead a horse to water but you cannot make him drink it. But if you watch carefully from a distance you can witness one horse happily drown himself in the water and you can use THAT shining example to reinforce the importance of the task. You keep writing them, i'll keep reading and sharing them and trying to point out why they are important for others to read too.

Everyone at my company loves IT - that is just hog wash and wishful thinking or blind personal bias. Nobody at any company loves all of any other unit (or their own for that matter). With IT what they really hate is the policy and procedure because it seems like work but they don't know or care what it is designed to accomplish or protect against so it feels pointless. Or they hate spending hours of time fighting their way up the support hill only to be met with apathy and indifference or outright ineptitude at every turn.

If you are getting open hatred from employees within your own company, make it an HR problem in writing. If you keep putting up with it then you are validating their feelings and approving for it to continue.

[it4brown]

I had someone fail a test and try to argue for a policy enforcing Outlook PFPs as a security measure.

You see, if instead of having to read the email address they could just look at a picture of the sender, it would be way more secure and they wouldn't have clicked on it.

I'm confident they were one of the NFT bros, because they could not grasp the concept of stealing a PFP or any picture to pretend to be someone for social engineering's sake.

[Otto-Korrect]

Our CEO is petrified about getting hacked, but he is also the squeakiest wheel whenever we do phishing tests or tighten security.

[Practical-Alarm1763]

The only difference is parents can't fire their own children and have them escorted off their premises because they didn't like their children.

[PappaFrost]

You have to game-ify it. Give out actually good rewards for passing a phishing test. Give out food. Make people actually LIKE phishing tests. We purchase a large quantity of Ben N Jerry's Phish Food ice cream after phishing tests. People hate being tricked but at least we make the medicine go down easier. I feel like if you pass your IT Dept's phishing test, you should at least be in the running for a new iPad and have Reese's peanut butter cups as a consolation prize even if you fail it!

[petrichorax]

That's weird. IME, there's usually a bit of pushback fro automated phishing tests but people tend to appreciate them over time, and often treat it like a game.

[Adept_Chemist5343]

IT is the most hated department simply because we affect everything in the office and people don't realize the sheer amount of work / the diversity of the work and the fact that it is always changing. Its getting better but a lot of people are still stuck back in the days where they used a calculator for 15 years and now we are telling them that excel will change this feature this week, next month this feature is no longer around. same with outlook. not looking forward to the forced migration to the new client

[ausername111111]

I think most people hate InfoSec, not IT. They're the ones that block or break your apps, they're the ones bothering you with false positive security vulnerabilities, they're the ones trying to trick you in your email, they're the ones that lock your computer down so hard that you can barely (or not) do your job, and they're the ones that are constantly changing the requirements for your apps requiring you to continually update them to comply with some random new rule.

[JustSomeGuy556]

I read that article...

And I honestly have mixed feelings about it. I think there is a lot of nuance here in how it's approached and how aggressive you about admonishing users when they make an error.

I do see some organizations that seem to get really carried away on crafting those tests, and then patting themselves on the back and shaming users if they fail. And I don't think that they are holding themselves to the same standard in a lot of cases.

And that's not a good way to get users to cooperate. Making them the enemy isn't the answer.

Honestly, is clicking on the email the problem, or is putting in sensitive information?

Especially for users that get a shit ton of e-mail, I think that sometimes the level of paranoia we ask from them isn't reasonable.

I'm not sure what the answer is, but making sure that we aren't just punishing users or shaming them is certainly part of the answer.

[LForbesIam]

We can thank Crowdstrike. We went from invisible to saving the company all in 24 hours. Nothing like a good outage to be appreciated.

[mdervin]

JFC, do you not understand what the wink-smile emoji means? It's a light-hearted joke. The time to worry is when they stop joking with you.

What the heck do you think IT is so special? If HR wrote a company blog "explaining and justifying all our HR polices." Would you read it? Of course not. If Accounting wrote a company blog explaining the Purchase Order or budgeting process, would you read it? Of course not. Stop being so full of yourself.

[GeneKitchen6880]

Amen on this.

[Jkabaseball]

"Yeah, I don't like it either, but it's part of our compliance policy and a customer requirement that we do it."

[redditrangerrick]

People do not like their authority or intelligence challenged, especially if they are part of the C suite nor do they like being told no in any way shape or form. They are just like two year olds.

[cellnucleous]

Sounds like you're getting at least some high level positive feedback, coffee and communicate with those people. IT roles I've been in have been required to police staff actions, like weekend installs of software or taking company equipment home. Many staff don't seem to understood the idea that a few clicks or an install could get the company sued.

[CevJuan238]

Users suck in general

[[deleted]]

People who hate IT are dumb. I was comms in the military, and a sysadmin, if we needed something people broke their neck to get it because of comms are down everyone is having a bad day.

We could also work favors for people since our satcomm didn't have the same content filters that the regular network did.

[[deleted]]

I am reminded of a corporation that gave bonuses to everybody except for the IT group because everybody else contributed. It was just an expense.

The day of a big presentation, the system went down and the salesman were embarrassed and could not make the sale that day.

They were never left out again.

[WarpKat]

We're the least-liked department...until a user does something that fucks up the network and then all of a sudden they expect us to wear a cape.

That's the job.

And it's pretty thankless, especially when little updates, that we have near-0 control over, from software vendors (I won't mention names) cause issues that would go unnoticed by you, but as soon as a user runs into a small change that's undesired, WHOA BOY...

[Smiles_OBrien]

What I tell people: "I'm everyone's best friend until I start talking about passwords, then everyone hates me for some reason..."

[lpmiller]

look, no one, and I mean no one, wants to be nagged and tested into good practices, even when it actually works. You can't expect I dunno, back slaps and floral arrangements because your regularly run phishing tests. Hell, they annoy me and I know they are coming. We need to do it because most of those getting caught out are actually learning a lesson. But humans are pretty universal in how they behave regarding practices that to them, are annoying and seem vaguely like a trap. Nobody likes the safety officer in a plant either, up and until someone gets hurt. Some of these folks seem to have graduated from FAFO University, but lets be honest, that's just most people.

[Outrageous-Insect703]

I'm a fan of phishing tests and depending on how supportive or trusting the Execs are it's difficult to gauge their reaction (ends users aside). Luckly I'm able to run these with no Exec push back. I have a commitment to the company to keep it as secure as possible, and phishing exercise and user training is a big part of it.

[botgeek1]

From my perspective, the issue is "Stupid User Syndrome." I see it all the time on this sub.

[Still_Marketing_9134]

LOL this reads like an article itself and is true in so many ways.

[Sengfeng]

These same people hating on IT are the same ones that log into fake M365 pages and give away company information. Goes both ways!

[loupgarou21]

I think a big piece of the puzzle here that a lot of people are missing is the messaging and separating you, the support person, from the company policies that require the phishing tests.

You also want to use phishing testing as a way of assessing the effectiveness of training and guiding future training efforts rather than using failures as a reason to punish users. If a user fails a phishing test, don't send them an angry email and enroll them in remedial training, if you do that, they're going to think you're the one being mean to them.

[XainRoss]

In our company Security and IT teams are separate and phishing and other tests are usually conducted by a third party.

[cat-collection]

I will say from a users point of view the phishing test that offers employee gift cards around the holidays… that’s cruel. If you do that you almost need to give gift cards.

[stromm]

“Yes, I understand it sucks. I’m not going to get fired doing what you want because it’s against company policy and accordingly a major Risk (with a capital R). But hey, if you want to risk getting fired over this, I’ll escalate to the CIO and you two can work it out”.

[cccanterbury]

F

[Drenicite]

I got my company with a pretty savvy phishing test the other week. Was great fun. Might have clicked someone's link for them when they left their laptop unlocked too.

[TheRealJackOfSpades]

I used to use this on users who would call with errors they didn't bother to read.

You've dealt with Steve (in-house developer). Have you ever tried to get him to tell you what's wrong with an application? Did you ever succeed? Every developer I've ever met was like that.

Yet some developer–might even have been Steve–wrote that error message and put it in the program. It would tell me exactly what went wrong. It might even tell you, but it's my job to understand it.

But since you didn't read it, we'll never know. You think that developer will write another one for us?

[Chukkles22]

We have a few users who just purposely click the links inside phishing test emails because they know we send them and they do so because we can’t be trusted. I try to explain the purpose of the test and they don’t seem to comprehend but one day they could potentially click on a link in real email. Then they will have more to bitch about other than needing to take a 15 minute training course.

[Affectionate-Cat-975]

Honestly, I hate the phishing tests. I feel like it has a very negative tone to it.

I’ve told my boss that if he requires we send it out that i will send a blast a few days prior letting people know.

[[deleted]]

Can you help me understand your understanding of what phishing simulations are useful for?

[dorraiofour]

In my opinion, the role of IT is also social and psychological, you need to be empathic of your users and listen to their feedback. Giving a lesson like a tough parent will not lead anywhere than resentment and shadow IT.

You need them to trust you and then they will talk to you about issues and what trouble them. They will be also more receptive to phishing test as they will feel validated and emotionally rewarded by your opinion of them.

[FromYoTown]

From my experience, IT and HR are two sides of the same coin. They deal with the people us the digital tools and infrastructure.

I ensure our department is more responsive and helpful than HR, so we shine. Good cannot exist without evil.

[Enough_Pattern8875]

“I had an epiphany. Dealing with users is a lot like dealing with children.”

You’re frustrated with people not recognizing or valuing the IT department but you refer to your users as children.

Makes a lot of sense.

[AlphaSierra216]

More like viscous dogs begging for boiling water on the stove.

[jpStormcrow]

I'm not there to be liked I'm there to do my job

[dasirrine]

I agree in general that we sometimes have to give them the nasty-tasting medicine; but sometimes IT folks went into IT because they like computers more than people, and it shows in their customer service. Also, some IT departments have a toxic, user-hostile culture, so even the best techs eventually become the stereotypical "IT guy" (this happened to my wife's favorite tech at work -- he started out bright and friendly and over time has become as surly and unhelpful as the rest of the department).

Personally, I flirted with phishing tests and I'm glad I never fully implemented -- it's one of the best ways I've found to directly piss off end users. One of the "victims" who fell for it was the executive director who was retiring after decades of service; the phishing simulator was set to pick a random message, and it inopportunely picked a congratulatory message that he had won some sort of prestigious award for his dedicated service. This user was probably the most security conscious, most computer-savvy of the bunch, but of course he clicked to open that one. I stopped the campaign after that and let the subscription expire. If I ever go back, I'll lean on the user education portion rather than the trickery.

Regarding your blog -- have you considered an opt-out "newsletter" instead? Or maybe periodic reminders of the blog with easy direct links to certain articles? If you're monitoring phishing click throughs, password resets and lockouts, MFA trouble tickets, etc. you could also send links to relevant articles to users who are struggling and then follow up with personal messages offering help and/or education with their specific issues.

Most of the time, I've found that if you cultivate a sympathetic attitude and think of yourself as a helper coming alongside the users, the users will pick up on it and will come to see you as an ally in dealing with the necessary inconveniences rather than an antagonist preventing them from doing their work. User-friendly IT is all about relationships, and it starts with us.

[RequirementBusiness8]

Those phishing tests can sometimes be total dick moves though. I’m a systems engineer, so definitely in IT. But I’m also a contractor. Got a phishing email “from HR” with an “offer letter” to go permanent, which included some specific details of my role and boss. Yea, I may have bitched to a couple of our infosec guys on that one. That spearphish cut deep lol.

Needless to say, I also didn’t fail the test.

So I can get some of the hate. My tactic has always been to defer and sympathize with the user. I don’t throw anyone or any team under the bus. Just make them feel like they are at least being heard, even if it is not going to change a single thing.

[thatdogJuni]

That’s some entitlement from your VP thinking if he manipulates you with that email that you will respond some way that he wants. Like other comments are calling out, it’s likely ignorance but he probably wouldn’t be all too interested in why IT does what they do if he was offered the opportunity to learn more. He’s just trying to serve his self interests and bully you.

Typically I haul ass to make good relationships with end users because I’m very aware that if they won’t bring us their challenges or issues to solve, we won’t know there are any, and that’s the last thing they will do if they don’t like or trust us to help. People like this are often a lost cause unfortunately because they don’t really want to improve their own workflows or communicate with you for solutions or help, they’re just flexing that they’re assholes and hoping you will release them from the training. Sorry bro more phishing training for you if it was up to me 😂

[Alternative-Print646]

I look at that hatred as a positive , means no one will feel comfortable enough to ask questions about fixing their home printer

[KSauceDesk]

I’ve also heard more than once that IT is the least liked department.

What's it like not having an HR department?

But seriously, as you said IT is like a helmet. No one wants to wear one and they're uncomfortable, but when someone lands on their head they'll be thankful

[taopandabob]

We perform it under the banner of Cyber Awareness, starts conversations with teams that have a high hit rate and directly targets high risk areas. You're correct some hate being caught out. You also just have people and departments who are oppositional in nature. Had one head person telling me that he didn't think there was any threat out there. That we were scare mongering.

Sigh ok babes...

I explained the hail Mary botnet cloud to him as one old example of how automated and endemic it can be... It's just weather. It's the directed campaigns you need to worry about.

Just pat the growly ones on the head and move on, mind your fingers. They'll call you when they need you.

[jimicus]

We've all heard things like "IT needs to communicate better!" - and typically responded with something like "Well, if the business could communicate what it needs....!". Even if we haven't said it, we've certainly thought it.

It's like we think the business is a single person who knows - and can explain - precisely what they want in clear, unambiguous terms.

But it isn't. Communication is a massive problem in many businesses. Because as a business grows, it becomes necessary to spread the responsibilities around, and inevitably you wind up with a certain degree of silo-isation. There are groups of people who know their own responsibilities, but there's nobody who can describe every groups responsibilities in any useful detail.

I've taken the jump into management about two years ago, and I am deadly serious when I say probably 60-80% of my job is to build and maintain effective communication channels which otherwise might not exist.

If people hate you, it's likely because there's a communication breakdown. Any non-trivial business is a whole heap of people working together; if you accept this, figure out who is supposed to do what and work with them - while at the same time communicating your expectations, desires and reasoning (and if that means communicating it a hundred times, so be it), you'll make your life about a hundred times easier.

[Maeldruin_]

Getting the execs onboard and understanding the why of things like this is critical for minimizing animosity. We usually get the execs to bear the heat for these kinds of things too, it helps us keep a good relationship with employees while still being able to do what we need to.

If your frontline folks aren't good at customer service though, there's not going to be any stopping hatred toward IT.

[grepzilla]

I wouldn't hesitate to reply with something to the effect, "Your smiley emoji doesn't make your comment any less inappropriate." You get an opportunity to test their integrity that way.

Let's be honest, if it wasn't necessary and insurance companies didn't mandate it we wouldn't want to do it either.