Bullying your co-workers with Phishing emails | Mr. Sprawl | BSides312 2026

Most corporate phishing programs fail because they prioritize vanity metrics over actual behavioral change. Modern methods are easily identified and almost useless. This session provides corporate security teams with a proven blueprint to transform phishing simulations from a "check-the-box" exercise into a high-engagement security initiative. We will explore a method that combines scheduled and spontaneous simulations to keep users vigilant. Attendees will learn how to transition away from "death by training videos" toward interactive "Lunch & Learns" that have reduced one startup's click rate from 40% to under 10% in a year. Learn how to humanize security, engage peers like a game of "I Spy," and move security out of the shadows. --- About Mr. Sprawl: Professional Phisher I am a social engineering enthusiast. Getting myself through school, into concerts, and even into jobs through social engineering I find how humans work interesting and enjoyable. Currently I'm the residing Email Engineer at [REDACTED]. I've done red team, blue team, and everything in between but always return to Phishing. Recorded live at BSides312 2026. --- Chapters: 0:00 Introduction 0:40 Who This Talk Is For 1:30 Does Your Phishing Campaign Look the Same Every Time? 2:20 Tools: GoPhish, Barracuda, Proofpoint 3:20 You Need a Willingness to Annoy Your Peers 3:50 The Dungeon Master Analogy 4:40 Boilerplate and the Check-the-Box Mentality 5:30 Nobody Remembers Ads 6:20 The Alternative: Lunch and Learns 7:40 Coming Out of the Shadows 8:20 How to Run It: Live, Virtual, Recorded 9:40 Your Face Is Your Selling Point 10:40 Show the Email and Let Them Solve It 11:40 Then Highlight Every Red Flag 13:00 Participation Begets Experience 14:00 Passed Over Because Nobody Knows You 15:00 Social Engineering Your Own CEO 15:40 Getting Started: Resources Means Your Time 16:40 Getting Buy-In From Stakeholders 17:20 Clicked vs. Reported, Opened vs. Ignored 18:00 Schrodinger's Email 19:00 MGM: Not Ocean's Eleven, Just a Phone Call 19:20 Make the Emails Personal and Local 21:20 The Result: 40% Click Rate Down to Under 10% 22:00 Q&A: What to Do With People Who Fail 24:00 Q&A: Applying This Externally --- Mentioned in this talk: - GoPhish - Barracuda - Proofpoint Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw