What a bathroom mishap taught me about getting caught with my guard down
Nothing will make you launch a deodorant bar across the bathroom faster than that little plastic guard on the end of a fresh stick.
This morning I woke up at six o’clock, took a shower, marinated in scalding hot water until my skin was nice and soft, stepped out, grabbed the deodorant, and vigorously rubbed it under my armpit before my brain caught up with my hand.
I think I exfoliated my armpit hair clean off.
There I was, half awake, running on muscle memory, doing something I have done thousands of times in my life. And in about two seconds of distracted autopilot, I caused myself a small but very memorable problem.
Somewhere in that traumatic experience, there is a cybersecurity story trying to get out. So let me tell it.
The morning a cybersecurity guy got phished
Picture this. Someone we will call “a guy who owns and operates a cybersecurity and technology services company” was sitting at a stoplight one morning, knocking out emails on his phone, trying to get ahead before the day even started.
An email popped in. Looked like Microsoft 365. Password expired. Click here to reset.
In a fit of pure efficiency, this someone tapped the link without thinking. Just trying to clear one more thing off the list before the light turned green.
The screen lit up immediately.
“Gotcha! You just clicked a simulated phishing email.”
Caught. By his own company’s phishing testing platform. The one he pays for. The one his team deployed. The one designed specifically to keep people from doing exactly the thing he just did.
Needless to say, that incident gets brought up around the office with a frequency that borders on workplace harassment.
Why this keeps happening to smart people
Here is the uncomfortable truth about phishing. It does not work because the targets are stupid. It works because the targets are busy.
The deodorant guard was not hiding. It was right there in plain sight. I have seen thousands of them. I know what they look like. I know what they are for. None of that mattered, because at six in the morning, with hot water still running off me, I was not really looking. I was running a routine.
That is exactly how phishing emails get through. The bad guys are not trying to fool you when you are sitting at your desk with a fresh cup of coffee, paying close attention. They are counting on catching you:
At a stoplight. Walking between meetings. Five minutes before a deadline. Right after lunch when you are foggy. First thing in the morning before you have woken up. Any moment you are running on autopilot instead of really looking.
The email looked legitimate enough. The sense of urgency was baked right in. Password expired. Click now or lose access. Hurry up. The whole point of the design was to bypass the part of my brain that asks questions and go straight to the part that just wants to handle it and move on.
It worked.
Three lessons worth taking with you
Phishing is about attention, not intelligence. Anyone, on any given morning, in any given moment of distraction, can click the wrong link. If you think you are immune, you are exactly the person who will get caught next.
Slow down, especially when you are rushed. The harder an email pushes you to act fast, the more reason there is to pause. Urgency is the single most reliable signal that something is trying to slip past your judgment.
Phishing simulations are not punishment. They are practice. Getting caught by a fake one is annoying. Getting caught by a real one is a whole different conversation, usually with attorneys and a cyber insurance carrier present. I would rather take the ribbing from my team a hundred times over than make that other phone call once.
The takeaway
Be vigilant out there, friends. If it can happen to a guy who runs a cybersecurity company, it can happen to anyone. And not everyone has a crack team of smart-aleck cybersecurity professionals on standby to save them from their own mistakes.
If your organization is not running phishing simulations and ongoing security awareness training, you are basically asking your team to spot the deodorant guard at six in the morning, every morning, with no coffee and no second chances.
Some of them will catch it. Some of them will not. And the ones who do not are the ones who will end up with a problem a whole lot more expensive than a Band-Aid on a rigorously exfoliated armpit.
Brian Largent
Father to five, husband to one, founder, CEO, and all around swell fella (or so I'm told)
