Launch HN: Riot (YC W20) – Phishing training for your team

&gt; Would love to hear your war stories on phishing scams, and how you train your teams!<p>I was working on anti-phishing in 2003, before it had the name phishing. We were trying to teach our users not to fall for the scams.<p>It didn&#x27;t work. People will fall for the same scam over and over.<p>The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100% coverage.<p>I wish you luck, but don&#x27;t get discouraged if it doesn&#x27;t work. We&#x27;ve been trying to educate people about phishing for 17+ years. :)<p>We shifted our focus to tracking the phishing sites and then tying that back to which user accounts were hacked, and disabling the hacked accounts and notifying the users before damage could be done.<p>PayPal actually holds the patent on what we built, along with a ton of other anti-phishing and phishing site tracking patents.

How do you work with the service providers you use to host your platform and send out emails (e.g. Heroku &#x2F; Mailgun) to let them know you are not a malicious phishing company, but an anti-phishing company?<p>I say this because I ended up reporting the phishing email I received from you guys to Mailgun, and I believe accidentally got your account disabled. Sorry about that.

&gt; &quot;I was pissed&quot;<p>How do you balance&#x2F;deal with &quot;security shaming&quot;, which is proven to put you further at risk as an organization?<p>There is some interesting research from the UK Government in this space - <a href="https:&#x2F;&#x2F;www.ncsc.gov.uk&#x2F;blog-post&#x2F;trouble-phishing#section_3" rel="nofollow">https:&#x2F;&#x2F;www.ncsc.gov.uk&#x2F;blog-post&#x2F;trouble-phishing#section_3</a><p>The relevant bit:<p>&quot;If just one user reports a phish, you can get a head start on defending your company against that phishing campaign and every spotted email is one less opportunity for attackers...but phishing your own users isn&#x27;t your only option.<p>Try being more creative; some companies have had a lot of success with training that gets the participants to craft their own phishing email, giving them a much richer view of the influence techniques used. Others are experimenting with gamification, making a friendly competition between peers, rather than an &#x27;us vs them&#x27; situation with security.&quot;

I work at a large professional services firm (think Big 4), so the risk of any single breach in our network is taken pretty seriously. Our IT department added an Outlook plugin years ago that you can use to immediately reporting phishing attempts to them. As a bonus, they&#x27;ll sometimes send these &quot;tests&quot; and if you select to &quot;Report Phishing&quot;, you&#x27;ll get a atta-boy type notification. I would assume at a macro level, they have stats on everyone and know who the &quot;riskier&quot; employees are. I have no idea if this is done inhouse at other large companies.<p>Sidenote&#x2F; question for you: some of the &quot;test&quot; attacks my company sends are very specific to the work we&#x27;re doing and can sometimes sound very convincing. Do you have a catalogue of &quot;attacks&quot; based on industry or department (procurement might fall for something completely different than sales or marketing)? I&#x27;m sure with enough tests, you could measure the effectiveness of attacks (or maybe the difficulty of detection)... then you can start rating organizations not just based on what percentage of folks fell for it, but what specifically they fell for, or what was more likely to get them to bite. Almost like targeted training?<p>Cool idea overall and wish you guys the best.

Hi Ben - cool product! Speaking as the lead for Riot.im, I would recommend picking another name asap, if nothing else because Riot Games has an awful lot of lawyers (as we know first hand, unfortunately).

Everyone&#x27;s vulnerable to phishing, no matter how technically literate. It&#x27;s too easy to click through an email during a moment of inattention. I&#x27;ve often thought that the only way to reliably prevent phishing is to enforce the use of a password manager browser extension, which will refuse to enter a saved password except on the original domain. Nobody should ever be manually typing passwords, or even copy-pasting passwords (in the rare case copying becomes necessary, it should be done with a big bold warning).<p>A safer, phish-proof enterprise password manager may be your killer product here.

Pricing feedback. I would love this type of training for our small team of 12 people BUT at this time, I cannot spend $199&#x2F;Month even though one could argue that there is no cost high enough for security. Perhaps add another smaller tier for companies with 20 or less employees in the 2 digit range ?

At the company I work at they send phishing training emails every now and then. Luckily, the email headers have special fields, so that the IT firewall lets the &quot;spam&quot; through. I managed to set up a rule in my outlook to catch these headers and move all the emails to a special &quot;Phish&quot; folder.

I wonder if you can comment on the weirdly pro-phishing behavior of <i>many</i> US banks who, if I didn&#x27;t know better, appear to be <i>trying hard</i> to make their customers vulnerable to phishing attacks ...<p>- TIAA Bank redirects customers, after login, to &quot;cibng.ibanking-services.com&quot;.<p>- US Bank, depending on which account you log into will redirect you to &quot;loansphereservicingdigital.bkiconnect.com&quot;.<p>- Union Bank will redirect you to &quot;unionbank.customercarenet.com&quot; if you look at a mortgage account.<p>These are big, serious US Banks and these domain jumpings (to domains that almost look like <i>parodies</i> of an actual bank domain) occur to every online banking customer.<p>They are training their customers to be phished.<p>FWIW, I have never seen Wells Fargo do this ...

I always thought the point of fire drills was to inure people to them so that in case of an emergency they would just blasély treat it like a drill instead of panicking: you want them to treat a real positive like a false positive.<p>Injecting false positives generally can impair quality and whether or not quality will be impaired or improved with false positives is really context dependent. Indeed, low false positive rates are often used as a measure of quality, so in generally you don&#x27;t want to increase them carelessly.<p>In the case of things like phishing training, I imagine (but I could be wrong) that the injection of false positives just causes the people who recognize phishing emails to ignore them instead of reporting them: there is too much noise and too little signal. The people who don&#x27;t recognize them will continue to fall victim. In that case, inuring the knowledgeable seems detrimental since you lose the likelihood of receiving a report.<p>I follow inbox zero practices and routinely delete all my email. Since forwarding a phishing email to security is a lot more complicated then hitting the delete key (like I probably just did for another email) I&#x27;m personally most likely to delete phishing emails unless I am getting them very rarely or it seems especially pernicious. Indeed, most of the phishing emails I receive lack a certain phishy feeling (like lacking a DKIM signature or other weird mail header shenanigans). I generally just assume they are these sorts of false positives.

This is a hot area, but there are already huge competitors. How do you differentiate?

My company uses Knowbe4, and I&#x27;m constantly frustrated how it considers it a fail if I only click a link vs entering in credentials. Sometimes it&#x27;s tough to tell if something is phishing when your checking email on your phone. Does Riot work the same way? Or do you test to see if users notice issues once they&#x27;ve actually opened something in the browser?

Love the idea! Unfortunately the IT group in my company is swamped with COVID-19 related work at the moment. But will be sure to bring it up with them once things calm down a little.<p>My company recently had a user fall for a very poor phishing attack (entered password into a Google Sheets request) so something like this could save IT and the company a lot of money.

Honestly I mixed this with riot.im

Great idea, just some copywriting fixes:<p>1. &quot;runs the latest scams techniques on your team&quot; should be &quot;runs the latest scam techniques on your team&quot;<p>2. &quot;trainings&quot; while technically a word, native English speakers will find it odd as you rarely see it used. use &quot;training&quot; instead, ex: &quot;We get it: trainings are annoying&quot; to &quot;We get it: training is annoying&quot;<p>3. &quot;Riot offers an interactive, tailor-made 5-minutes training your employees will actually enjoy and learn from.&quot; to &quot;Riot offers an interactive, tailor-made, 5-minute training your employees will actually enjoy and learn from.&quot;<p>4. &quot;Riot will perform attacks and trainings on your team&quot; to &quot;Riot will perform attacks and training for your team&quot;

That&#x27;s an unfortunate business name

True story (except for the last two lines):<p>Boss: install this antivirus and run it: [link].<p>Me: I dunno, that seems like a phishing attempt... is that really you, boss? What&#x27;s the code word?<p>Boss: DO IT OR YOU ARE FIRED!<p>Me: oh yeah, definitely you; installing it right now.

The only time that a phishing attempt actually worked for our company (afaik) occurred when someone emailed an executive in our company (ugh) with a docusign looking email with content that he was EXPECTING. it redirected him to a fake Active Directory sign in link that he fell for. Immediately after entering his password his outlook spammed his entire contact list with the same phish except addressed to them specifically from his actual email, with a link that looked like a shared Office 365 document. It wasn&#x27;t good.

Curious how you differ from Cofense Phishme? <a href="https:&#x2F;&#x2F;cofense.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;cofense.com&#x2F;</a>

One that is happening in nearly every parish is that scammers are using church bulletins to get the personal info and then sending a &quot;message&quot; from the priest to those people. So while not CEO fraud it is very similar. A great setup and one that you could find a way that you charge when teams are doing the right thing... have the test be free and the training have a cost

It’s been honestly pretty fun to run this at BackerKit. Sad to say it caught my COO, but actually more inspiring seeing my team banding together and fighting back and letting folks know in Slack. Also, a bonus, a really cool lean use of Drift which inspired us to use that tool better.

Seems to be a hot topic recently. I first discovered <a href="https:&#x2F;&#x2F;www.hoxhunt.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.hoxhunt.com&#x2F;</a>, there are probably some other competitors as well, what makes you different?

How do you differentiate yourself with places like <a href="https:&#x2F;&#x2F;www.knowbe4.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.knowbe4.com&#x2F;</a> which offer free services against phishing.

You are double the price of knowbe4. How do you expect to possibly compete?

How do avoid spam filters when sending your fake phishing emails?

What are the steps necessary to get this up and running?<p>Step 1, 2, 3... Besides signing up. ESP if you have O365 or GApps for mail.

Why is this any better than product offerings from PhishMe, Wombat, or KnowBe4?

The copy in your post is great. I understood what you do straight away.

I invented this space. Ask me anything. Aaron Higbee

So we have Riot Games, Riot.im, and now this. As if two wasn&#x27;t enough confusion.