By Ken Hollow, unwilling trainee in email paranoia
Corporate security training is the modern workplace’s favorite pastime. Not because it works, but because it wastes hours of your life while teaching you absolutely nothing — except that your employer really enjoys sending fake phishing emails just to watch you squirm.
The Ritual of the Training Module
Every year, the email arrives: “Mandatory Security Awareness Training — Due EOD.” You click. You log into the clunky platform. And there it is: a 45-minute module featuring:
- Stock photos of hackers — hoodies, green code, someone typing furiously in the dark.
- Multiple choice quizzes — “Should you give your password to a stranger in a parking lot? (A) Yes. (B) No.”
- Videos with terrible acting — an intern pretending to be tricked by “CEO_urgent_request123@totallylegit.biz.”
By the end, you’ve learned nothing except that corporate training videos are written by people who have never seen a computer.
The Phishing Simulator: A Company’s Favorite Hobby
Then come the “tests.” Fake phishing emails sent by your own employer. Traps disguised as “HR gift cards” or “password resets.” Click once and suddenly you’re enrolled in more training. It’s workplace entrapment.
One time, IT sent out an email offering free coffee vouchers. Half the office clicked. The punishment? A stern company-wide email about “falling for scams.” The scam was you, IT.
The Illusion of Security
Security training doesn’t stop breaches. It just:
- Shames employees for being human.
- Pretends that clicking a PDF is the biggest threat, not the outdated servers management won’t upgrade.
- Gives IT a sense of superiority, as if they’ve outsmarted the peasants again.
Actual hackers don’t need phishing emails. They exploit the fact that your company’s password policy still requires you to change your login every 30 days and forbids using the same password twice — ensuring everyone just writes them on sticky notes.
Nana vs. the Phish
Naturally, Nana treats phishing like sport. She once replied to a fake “bank alert” email with a 12-page manifesto on velvet economics. The scammer blocked her.
When IT tried to phish her, she clicked on the fake link deliberately, then cursed the server farm. Half the office lost WiFi for an hour. She declared victory.
Why Companies Love It
- Cheap Blame: If a breach happens, they can say, “We trained our employees. It’s not our fault.”
- Illusion of Vigilance: Security theater looks good on shareholder slides.
- Endless Content: There’s always a new module to roll out. 2025’s hottest trend? “Phishing Awareness 2.0: Smishing and Vishing.”
Meanwhile, the only thing employees learn is to fear every email subject line. My inbox looks like a minefield.
Final Thoughts From the Spam Folder
Corporate security training isn’t training. It’s a phishing simulator run by your employer for their own amusement. You won’t stop hackers with stock photos and quizzes. You’ll just annoy employees until they start ignoring every email, real or fake.
If the company really wanted to improve security, they’d stop sending fake coupons and start paying for decent IT infrastructure. But sure — let’s all take another 45-minute module on not clicking links.
Ken Hollow, phishing victim, reluctant trainee, spam folder enthusiast
Hi. I’m Ken. I run Two Second Solutions, a one-man agency that somehow landed a fox spirit influencer as a client. I drink too much coffee, blog when I need to vent, and regularly update my résumé just in case she sets the office on fire again. I’m not crying — it’s just spell residue.