David Spark

So this one comes from Jared Mendenhall, who is the CISO over at Armature Systems.

And here are your two scenarios.

Michelle, remember, you're up first.

Scenario number one, your company is in the middle of a crisis where a phishing attack caused a massive breach.

Due to user error, your next phishing campaign is accidentally triggered.

sending similar-looking phishing messages to the community, causing a company-wide panic.

Not good.

No.

Scenario number two.

And by the way, audience, be prepared.

I'm going to look for your vote as well here.

It's open enrollment time for HR.

You send a phishing campaign telling users that their benefits have been canceled.

You do not notify HR beforehand, and HR is flooded with angry messages

HR and all the departments hate you, security.

It's questionable if they will ever regain trust.

All right, Michelle, if you will ever regain trust, the security department, which one is worse?

Yes, and you cause a company-wide panic.

Okay.

Actually, you cause a company-wide panic in both scenarios, too, for that matter.