The phone belongs in phishing training

An instruction to inspect the sender sounds straightforward until someone has to follow it in an unfamiliar email application. The training may show a cursor hovering over an address. On a phone, the employee needs the corresponding steps for the app in their hand. A desktop demonstration leaves that part of the lesson unfinished. Before expecting the check, establish how it can be done.

The UAE findings in KnowBe4's October 29 report (external source, opens in a new tab) make mobile use worth examining. Mobile-focused lures accounted for 10% of dangerous email in the UAE portion of its Defend telemetry, compared with 2.7% globally. These are vendor-reported email findings, not a measure of all UAE email or compromised phones. Its executive summary (external source, opens in a new tab) does not establish which applications recipients used; employers still need to examine their own.

Suppose a site supervisor is waiting for a revised drawing and a notification offers the file. The supervisor is using a phone at the site. Telling them to check the sender, avoid suspicious links, and use the approved document system gives them three instructions. The training still needs to show how those instructions fit together while retrieving the drawing. Otherwise, it has explained the precautions without rehearsing the task.

Teach ordinary document retrieval alongside the suspicious notification. In the supervisor's example, that could mean independently opening the organization's established work application and finding the drawing there, provided the business supports it on the phone. Show where to inspect the message and how to report it in the configured email app. Recognizing the sender alone cannot establish that an offered file is safe.

This belongs in the brief given to the training provider. Ask them to demonstrate the lesson in the mobile application staff actually use, with the organization's settings, rather than assuming a desktop sequence transfers. Include a legitimate notification so the employee also practices completing normal work. A generic mobile screenshot will not settle whether the reporting control is available in the configuration being taught.

Where a required step cannot be completed on the phone, provide an explicit alternative, such as a designated support contact or a check from an approved workstation. That may mean waiting, so the working arrangement needs to allow it. The supervisor should finish the lesson knowing how to obtain the drawing through an established application and what to do when the usual application or reporting control is unavailable at the site.