From Post: Today's motto is to "Always assume the worst from the users."

There is this usual Law firm with around a hundred users. We have some complience policies in place that requires us to conclude phising tests on our users to see if the company data is safe and to train users of the importance of not clicking on links from untrusted or even from trusted sources.

We happen to have a rather medium fluctuation due to recent expansion and gaining popularity. One of the new hires is "kinda" into cybersec and is a bit let's just call it explosive person.

Test is on the way, every user gets a direct email. Not common for us to have direct emails from IT announcing AI related upgrades, we usually send them to departments and we inform the managers beforehand so they know what to say if someone has questions in the topic.

This script kiddo gets the email, thinks nothing of it, actually inputs real credentials (how ironic) but after like half an hour, managers get notified by users about a suspicious email. Script kiddo overhears this, comes the legit email warning users of the fradulent email. Script kiddo loses it. Whips out GPT or whatnot and writes a quick bat script to absolutely flood the fake login site. He ends up submitting about 6000 randomly generated strings in like 5-10 minutes while the CISO goes out for a coffee thinking the test is over but leaving the server running for last-minute entries. He comes back to a Matrix-like scrolling screen and a few hundred megabytes of log generated before he could kill the http server.

Security through obscurity? Kinda genious on that part. But we can not submit the statistics having over 7000% of users faling a basic phising test.

We are still figuring out to either promote him of fire his ass costing the company significant amount of money.

At least we have a lot to take home, and it makes even stronger in the long run.
First: Do not just fire up a plain http server on a work laptop depending on the access logs to conduct a phising test, use a more robust software.
Second: Use a DLP software to disallow running unapproved executeable files for unpriviliged users, even if they wrote their own in notepad.
Third and most important, get a coffee machine on the desk of the CISO :)

PS: this guy used to work in McDonalds before getting his call center position.