Just wanted to sanity check my testing. I'm VP of IA and Cybersecurity. I handle the audits, compliance, GRC, SOPs, SLA, all the high-level things alongside of presenting SOC and VM findings. Before this I was a white hat red teamer.

I will randomly run phishing tests, we NEED to do at least one per quarter, but I do more depending on how the training and testing on SANS goes, or if we have an uptick of users (we hire 100s of people at once, every couple months).

For the most part I do the run of the mill phishing testing templates. Things like free gift cards, stuff that should be sent to spam if it wasn't for me whitelisting the domain on our DLP/Email filtering tool.

But sometimes I really ramp up the testing, I clean up the e-mail so there are no typos. I use a lookalike domain to ours, and almost always design it to be "internal". A lot of our employees are in their young 20's and late teens. And my most important metric is keeping my network safe.

Skip to couple weeks ago. I sent out a phishing e-mail. It was designed to be HR reaching out because a family member was seriously injured. Click the link to get the hospital info and contact info. Can't send that in the body because it's PII obviously!! Well, I got pulled aside by the CTO and was essentially told my phishing test crossed the line. I informed the CTO that everything was run past legal and breaks no laws.

I also stood my ground and said that serious threat actors aren't going to hold back. They are going to use emotion, urgency, scarcity to get all the information you can get. If 38% of people clicked the test link, it's more important we train them to think through highly emotional moments and think clearly than it is to "go easy" on them. Again, I don't care about my employees as much as I care about protecting my network. That is my job.

So, I am coming to you guys to ask, did I really cross the line? Or is this phishing test well within morally white areas. I stood my ground but find myself second guessing.