Transcript
Conference and Awards. And I am thrilled to be joined by Missy Benson. She is the Senior Security Training and Awareness Program Manager with DocuSign. So we're going to talk about all things security awareness today. And thanks so much for joining us for this conversation. So first of all, let's start right there. Tell us about yourself. Tell us about the overall security awareness program that you have at DocuSign. Yeah, absolutely. So just to give a little background. I've been in security for about 25 years now, and 15 of those officially this year is in security awareness. So very happy to know I'm kind of one of the originals, for sure. And through that time, I've worked in a variety of fields, but ultimately now with DocuSign, and I've been here three years. And as part of that program, I like to say that we have three functions. I call it my security cat, communications, awareness, and training, plus I like cats. And so within each of those pillars, I have obviously communication. So I oversee all of the communications within our security organization, whether it's internally facing and some external, and I'm starting to move more broadly into some more of our customer facing. And then awareness is always just the regular campaigns, helping employees make sure they know what they need to be aware of, if it's an alert that we need to get pushed out, or just general topics that we want to raise awareness on. And then lastly, our training, which is obviously our annual compliance training. So we have all our check the box, but then we have other trainings that we like to be able to do. And we're starting to get a lot more focused on persona and risk-based training this year. So we're really evolving the program. Great. Tell us a little bit more though about specifically what type of problems are you trying to solve in your work with Hawks Hunt? Yeah. So obviously social engineering is still one of the top risks. We're seeing that everywhere, every year, all the time. And Hawks Hunt has been an invaluable partner in helping us raise that awareness, identifying and now smishing, because we've also used their smishing modules as well as live trainings. And it's really helped us get the visibility up on what employees should be looking for. So one of our most recent smishing exercises, I thought was so fascinating to see how much people were posting about it in our Slack channels. It's really great to see that the communication is out there. I'm definitely an advocate of the employees talking about it to make others aware, because that's the biggest part of it, not keeping it to themselves and just doing something about it, but making others more aware. So like, hey, there's this potential threat. You need to do something about it. Yeah. Yeah. Dig in a little bit more as to why, when you were looking to solve some of these issues, you decided to select Hawks Hunt? Yeah, absolutely. So they are super easy to use. It's user friendly for myself on the back end, as well as our employees. It's a simple button to click. The users don't have to do anything themselves other than click. And we've even got to a point where it's a regular message within the company, Hawks Hunt it. So it's great to see, you know, we have kind of our own little built in champion program that I didn't even have to create. People just are actively doing it and love the ease of use. And the capabilities keep building. There's been more, as I said, we started with just fishing and the micro trainings, but now there's the smishing and it just continues to evolve. And we're looking forward to doing more. So what results do you think, you know, with your long experience too in the field have been most impressive? I think one of the biggest things seeing here with Hawks Hunt is the low click rate that we're getting. Since instituting Hawks Hunt, we've dropped down to the lowest click rate I've ever seen or even heard of personally. We're below 2% on average. And just seeing that is just beyond anything I've seen. And our engagement is gradually increasing. We're around industry there. I love that we're staying below industry for our click rates. Anything unexpected happen along the way that you were surprised about? I think one of the things actually was for myself. So DocuSign already had a partnership with Hawks Hunt when I started. And I came on board thinking, oh, three to five simulations every month. That seems excessive. Because I came from once a month or once a quarter was what I usually saw as a standard. And going to three to five, I don't even notice it myself. I just click it, report it, keep moving. And just hearing employees talk about the value of it and how easy it is for them. And then when they get upset, they lose their streak if they happen to click on one of the simulations. So that's always kind of fun. Yeah. Positive, negative in a way. Yeah. Yeah. Yeah. Yeah. What about feedback? What kind of feedback have you gotten from leadership about the program and about the work that you're doing with Hawks Hunt? Yeah. It's one of our major KPIs just for my area. So we always are reporting on phishing. And I'm actually trying to move over to the idea of resilience instead of just click rate. I think it's really important that we start to evolve that. And it's a proposal that I put out recently, and I'm hoping to move towards that. But it's an area that our leadership is always able to quickly see and grasp, knowing what our threat rate is, what our risk is, because the data is readily available. Hawks Hunt has a lot of reports that are easy to use and get the data as soon as I'm asked for it. Yeah. Yeah. So what are other employees saying or other security team members saying about the program? And that even goes back to what I was mentioning, how it's just Hawks Hunt. It's just a slogan. We're able to get the employees to just tell each other what to do. Our security team loves that they don't have to respond when people ask about things like, this looks suspicious, and they post it in Slack, and somebody else instantly responds with our Hawks Hunt emoji or just saying Hawks Hunt it. So it's really positive. And when we instituted the capability to put on vacation mode, people loved it because they weren't going to lose their streak anymore. Yeah. Yeah. Who would you recommend Hawks Hunt to? I think anyone that's in my space, honestly, because I think Hawks Hunt has been super easy for me. I plan to continue using it wherever I go if I'm not at DocuSign or just want to continue the partnership because honestly, it's not just about the capabilities that they provide to me, but the partnership as well. Hawks Hunt has been really good to partner with and discuss ideas that I have that I think would be good to implement and to understand what's on the road map. And it's just been really valuable in that sense. So it's not just a tool that I'm using. It's a partner that I work with. Interesting. Great. Well, Missy Benson, thank you for joining us today. Yes. Thank you so much. And thanks to you for watching. I'm Joan Goodchild with CSO. We'll see you next time.
