Phishing tests are important to keep the college safe

Every so often, the appear. Yes, Information Technology Services sees your complaints online. Another phishing simulation has completed its campaign across campus, and the familiar follow: “IT is just trying to trick us,” “Nobody falls for these,” or “Why aren’t they fixing the Wi-Fi instead?”

Ironically, it is not uncommon to see those same criticisms appear alongside questions whether an actual phishing email is legitimate. That alone is a reminder of why these exercises matter. It’s no fun taking tests, and it’s even less fun to fail one. But the purpose of phishing simulations is not to embarrass anyone or catch people making mistakes. Rather, the goal is to give you an opportunity to practice recognizing deception before someone with criminal intent is on the other end of the message.

Today’s phishing attacks can be remarkably sophisticated. Many are personalized, professionally written, and generated with the help of artificial intelligence. They impersonate professors, supervisors, financial institutions, vendors, and trusted organizations with remarkable accuracy. They are not designed to fool careless people; they are designed to fool busy people. And if you are reading this, chances are you are one of those busy people.

At Hillsdale College, that matters.

It’s not just staff with access to high-value information who are targets of phishing emails. It’s also students who are employees of the college and have access to information that outsiders want. Students work in academic departments, admissions, residence life, athletics, administrative offices, the library, and information technology. Any account, no matter what it has access to, can help someone build a better map of the institution for an attack.

A compromised account does not simply put an individual’s security at risk — it can become the starting point for an attack that affects coworkers, classmates, faculty, and the college itself. Protecting the college is not solely the responsibility of ITS. It is a shared responsibility. Every member of the campus community plays a part in safeguarding the people and resources entrusted to us.

That requires practice.

Hillsdale has long emphasized that habit forms character. We do not become responsible, trustworthy, or disciplined by accident. Those qualities are developed through repetition until they become second nature. Cybersecurity works much the same way. The habit of slowing down, questioning an unexpected request, verifying a sender, or reporting a suspicious message is developed through practice, not wishful thinking. Every phishing simulation is an opportunity to build those habits in a safe environment, where the only consequence of clicking is receiving a notification that you failed a phishing test.

The time a simulated phishing email appears in your inbox, don’t think of it as IT trying to fool you or as time we could have spent fixing Wi-Fi (which we are also doing). Think of it as your community asking you to invest a few moments of your time so that when a real attack arrives, you will be able to recognize it.

David M. Pauken is a cybersecurity engineer for Information Technology Services.