SE-B-17Level 1 · Signal
Reports SMS and voice lures
- Behavior
- Vigilant
- Level 1 · Signal
A vigilant behavior signal from the simulation platform: the person reported a simulated text message or phone lure through the reporting channel.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- DE.AE-06
- MITRE ATT&CK
-
- T1566.003
- T1566.004
The definition, in detail
Definition
It extends the reporting habit past email.
Example
A store manager forwards a simulated delivery text to the reporting address and warns her team in the group chat.
How it is measured
- Subject
- Person
- Event
- smishing.simulation.reported
- Risk domain
- Social engineering
- Provenance
- Framework research
How it is used
Programs count "Reports SMS and voice lures" per person from Awareness & phishing simulation and read it beside the other Social engineering signals; it feeds 0 cohorts, 0 sequences and 1 breach scenario.
A "reports SMS and voice lures" event is evidence of a protective behavior; a vigilant behavior at any step breaks a sequence. It is one event, and it does not cancel the risky signals the same person carries.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0006Enables phishing reporter buttons
- I.0007Reports suspected phishing or other suspicious emails to security for analysis
- I.0008Reports suspected phishing emails that are tagged as suspicious
- I.0009Reports real phishing emails
- I.0010Reports real phishing emails resulting in quarantine
- I.0011Reports legitimate emails as phishing emails
- I.0012Reports suspicious SMS messages
- I.0017Deletes phishing emails without opening
- I.0058Reports simulated phishing emails
- I.0059Forwards simulated phishing emails to security team
- I.0060Provides helpful feedback on simulated phishing emails
- I.0064Reports simulated SMS phishing messages
- I.0065Ignores or deletes simulated SMS phishing messages
- I.0068Denies simulated fraudulent MFA prompts and reports them
- I.0092Reports high confidence in phishing-related self assessments
- I.0097Fails phishing simulations less frequently over time
- I.0099Fails security simulations less frequently over time
- I.0130Reports phishing emails without clicking
- I.0136Hovers over links before clicking
Continue exploring
"Reports SMS and voice lures" (SE-B-17), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/se-b-17-reports-sms-and-voice-lures
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.