How to fix false positives with phish test results?

Question

Why am I getting false positives with phish simulation training results?

Answer 1

Hi @Cedric R. Porties,

Welcome to the Microsoft Q&A platform!

According to your description, you are experiencing false positive issues in phishing simulation training. Here are some common reasons why they may occur:

1. Many organizations use security tools to automatically scan and click links in emails to check for malicious content. These automated clicks may be mistaken for user interactions, resulting in false positives.
2. Some third-party email security services scan and detonate links in emails as part of their protection measures. If these actions are recorded as user clicks, this can also lead to false positives.
3. When using third-party reporting tools, simulated phishing emails may be scanned, trigger links and cause false positives.
4. Sometimes, checking the IP addresses associated with clicks can reveal that they come from security services rather than actual users.

To mitigate these issues, you can:

1. Implement allowlist measures for your phishing simulation emails to prevent security tools from interacting with them.
2. Utilize dedicated phishing simulation reporting tools designed to minimize false positives.
3. Conduct detailed investigations to determine the source of false positives and adjust security settings accordingly.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang