SE-B-04Level 1 · Signal
Clicks links in real phishing
A risky behavior signal from email security: the person clicked a link in a real phishing message after delivery, as recorded by URL rewriting or click-time protection.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- DE.CM-03
- MITRE ATT&CK
-
- T1204.001
The definition, in detail
Definition
The person has interacted with a live attack.
Example
A sales director clicks a link in a real invoice-themed message; the click log shows the page was blocked, and the person enters a 30-day watch.
How it is measured
- Source
- Email security
- Subject
- Person
- Event
- phishing.real.clicked
- Risk domain
- Social engineering
- Provenance
- Forrester, Verizon DBIR, Framework research
How it is used
Programs count "Clicks links in real phishing" per person from Email security and read it beside the other Social engineering signals; it feeds 3 cohorts, 2 sequences and 3 breach scenarios.
A "clicks links in real phishing" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0001Opens real phishing emails
- I.0005Clicks links in real phishing emails
- I.0013Replies to emails from unknown or spoofed senders
- I.0015Opens attachments from quarantined email messages
- I.0016Opens attachments from email messages with unknown senders
- I.0018Marks legitimate security alerts as junk messages
- I.0019Replies to flagged phishing emails after warning
- I.0020Downloads attachments from emails with mismatched display name and sender
- I.0021Configures a mailbox rule that bypasses security controls
- I.0026Accepts file transfers from unknown external contacts
- I.0028Attempts to bypass attachment blocking by renaming files
- I.0029Adds potentially risky domains to "safe senders" list
- I.0030Replies all with external recipients
- I.0031Deletes security banner before sending messages
- I.0037Interacts with calendar invites that may pose security risk
- I.0039Clicks links in SMS messages from unknown senders or as part of SMS phishing simulation
- I.0040Enables macros in untrusted documents
- I.0041Accesses shortened URLs from unknown sources
- I.0042Attempts to download content from email messages with blocked external images
- I.0043Accepts redirected links from unknown domains
- I.0044Accepts shared file invites from spoofed domains
- I.0045Clicks unsubscribe links in unsolicited newsletters
- I.0046Opens encrypted messages from unverified senders
- I.0050Disables or tampers with emails security controls
- I.0051Opens simulated phishing emails one or more times
- I.0052Clicks links in simulated phishing emails
- I.0053Enters credentials on websites linked from simulated phishing emails
- I.0054Opens file attachments to simulated phishing emails
- I.0055Fails to report simulated phishing emails after opening
- I.0056Deletes simulated phishing emails without reporting
- I.0057Responds to simulated phishing emails
- I.0061Opens simulated SMS phishing messages
- I.0062Responds to simulated SMS phishing messages
- I.0063Fails to report simulated SMS phishing messages
- I.0066Does not respond to simulated fraudulent MFA prompts
- I.0067Marks simulated fraudulent MFA prompts as mistaken
- I.0093Reports low confidence in phishing-related self assessments
- I.0117Opens shortened URLs from unknown senders
- I.0243Demonstrates susceptibility to authority exploitation
- I.0244Demonstrates susceptibility to urgency and scarcity pressure
- I.0245Demonstrates susceptibility to fear and intimidation
- I.0246Demonstrates susceptibility to trust and familiarity abuse
- I.0247Demonstrates susceptibility to reciprocity and obligation
- I.0248Demonstrates susceptibility to curiosity and novelty triggers
- I.0249Demonstrates susceptibility to greed and reward motivation
- I.0250Demonstrates susceptibility to empathy and helpfulness
- I.0251Demonstrates susceptibility to commitment and consistency
- I.0252Demonstrates susceptibility to social proof and herd mentality
- I.0253Demonstrates susceptibility to overconfidence exploitation
- I.0254Demonstrates susceptibility to fatigue and cognitive overload
- I.0255Demonstrates susceptibility to fear of missing out (FOMO)
- I.0256Demonstrates susceptibility to sympathy manipulation
- I.0257Demonstrates susceptibility to pretexting deception
Continue exploring
"Clicks links in real phishing" (SE-B-04), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/se-b-04-clicks-links-in-real-phishing
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.