In a mock phishing scenario conducted between March and May, the New York CSCIC sent spoofed e-mails to about 10,000 employees across five state agencies, trying to trick users into surrendering their passwords. More than 75% of the recipients opened the e-mail, 17% followed the link, and 15% attempted to enter their passwords, Pelgrin said.
In an exercise two months later—after users were educated about the technique—only 8% of respondents opened the e-mail, Pelgrin said.
