What would you do if an email showed up in your inbox offering you an exclusive company gift? Would you click?
According to a report from Yahoo Sports, several Madison Square Garden employees faced exactly that question. They received an email announcing, “Congratulations, your Employee Championship Ring is here,” with two ring designs to choose from. Employees who clicked the link didn’t get a ring. Instead, they were reportedly enrolled in a mandatory cybersecurity class, because the email was a phishing test.
It’s a memorable example of one of cybersecurity’s biggest challenges: technology can protect your organization, but employees still need to recognize when something doesn’t look right.
Why This Phishing Test Worked
The message didn’t make an obviously suspicious request. It offered something employees might genuinely want, and that’s exactly how social engineering works. Attackers don’t always need a technical vulnerability when they can convince a person to click a link, open a file, enter a password or approve a request.
The championship ring email shows several warning signs every employee should learn to recognize:
- An unexpected offer or reward
- A reason to click right away
- A message tailored to something the recipient cares about
- A link that leads away from normal business tools
- An offer just believable enough to lower someone’s guard
Real attackers use the same tactics in fake Microsoft 365 notifications, password expiration notices, shared documents, invoices, payroll messages, delivery alerts, urgent requests from “executives” and vendor emails.
Security Awareness Training Needs to Feel Real
Traditional cybersecurity training often becomes something employees click through once a year. Effective security awareness is different. It reinforces good habits throughout the year with realistic scenarios and practical education. A strong program includes:
- Phishing simulations: controlled test emails that help employees practice spotting suspicious messages before a real attack arrives
- Short, ongoing training: regular reminders throughout the year instead of one long annual session
- Microsoft 365 security education: how to recognize suspicious sign-in alerts, unexpected file-sharing requests, unusual MFA prompts and fake login pages
- Clear reporting procedures: so everyone knows exactly what to do when something looks suspicious
Just as important, build a culture where employees feel comfortable reporting a mistake quickly. The sooner IT knows, the less damage an attacker can do.
The Goal Isn’t to Trick Employees
Security awareness shouldn’t be about embarrassing people who click. It’s about building better habits.
An employee who clicks a simulation has simply shown where more training will help. And your organization gets a chance to strengthen its defenses before a real attack arrives. A good program shifts the conversation from “Who failed the phishing test?” to “How do we help everyone recognize the next attack?”
Cybersecurity Is Both Technology and People
Businesses invest in important security technology, such as endpoint detection and response (EDR), identity threat detection, email security, multi-factor authentication, Microsoft 365 security controls, security monitoring, backup and recovery, and managed detection and response.
Those protections matter. But attackers keep targeting employees because convincing someone to hand over access is often easier than breaking through the technology. That’s why security awareness training should be part of a broader cybersecurity strategy, not a standalone compliance checkbox.
What Long Island and NYC Businesses Should Take Away
For businesses across Long Island, New York City and the Tri-State area, the lesson is simple: your employees are a key part of your cybersecurity defense. Whether you have 20 employees or hundreds, security awareness training helps your team recognize suspicious activity and know exactly what to do about it.
The best time to teach someone to spot a phishing attack is before a real attacker sends one.
Build a Stronger Human Firewall With TCI Technologies
TCI Technologies helps businesses strengthen cybersecurity by combining security awareness training and phishing simulations with email security, endpoint protection, identity security, Microsoft 365 security, monitoring and managed cybersecurity services. Instead of treating training as an isolated requirement, we build it into a security program designed around your people, systems and risks.
Is your team ready for the next phishing email? Take our free Cybersecurity Risk Assessment to get your Security Readiness Score, or learn more about our Security Awareness Training. Prefer to talk? Call us at (516) 484-5151.
