They promised employees championship rings. It was phishing.

ISSUE #45 • FRIDAY, OCTOBER 30, 2026 • 5 MIN READ

Friday. Thanks for spending another week with Still Monday. Today's story comes from the department of “technically educational, emotionally villainous.”

Imagine getting an email saying your championship team is giving employees rings. You click to choose yours.

Congratulations. Mandatory cybersecurity training.

Madison Square Garden used a championship-ring offer in an internal phishing simulation after the New York Knicks won the NBA title. Employees received an email congratulating them and showing ring designs. Clicking the link sent them to mandatory cybersecurity training. MSG later called the choice of bait an “unfortunate mistake.” Associated Press

It is hard to invent a better Still Monday story. The security team wanted employees to learn not to trust unusually attractive emails. To prove the point, it sent an unusually attractive email from the company itself.

Phishing tests exist for a good reason. Credential theft often begins with a message that creates urgency, curiosity or reward. Training people to slow down before clicking can prevent real damage.

A recent Eurobarometer found three in four EU employees had encountered suspicious emails, messages or links at work. Phishing was the most common threat, reported by 39%. European Commission

If the test feels like humiliation, employees learn a second lesson: the security team is trying to catch them. That can reduce reporting, especially when somebody realizes after clicking that they may have made a mistake.

The best security culture makes the safe behavior easy and socially cheap. Report suspicious mail. Verify unexpected requests through another channel. Admit the click quickly if something got through.

A simulation should resemble the tactics employees will face and end with a useful explanation: what clues were present, what the correct action was and how to report a real message.

You want employees suspicious of the email. You do not want them suspicious of every good thing the company promises them. Especially the jewelry.

SPONSORED

A shopper types “running shos” and gets nothing back. Another types “red waterprof trail runners under $150” and hits the same wall. Both knew what they wanted.

Traditional site search relies on exact keyword matching, leaving shoppers stranded at “0 results found” screens.

Gladly understands what shoppers mean, typos and all. Instead of a dead end, they get products that fit what they asked for and a conversation that keeps them shopping.

See how Gladly turns dead-end searches into sales

Turn Dead Ends Into Sales

Urgency, authority, curiosity and reward are reliable triggers. Attackers do not need to beat your firewall if they can persuade somebody to open the door.

A fast report gives security teams a chance to disable accounts, block domains or warn other employees. A culture where people are afraid to admit a click wastes that advantage.

The Eurobarometer found only 48% of employees said they could recognize an AI-generated fake video. Visual polish is becoming weaker evidence that something is legitimate.

When a message asks for credentials, money, sensitive data or an unusual action, verify it through a channel you already trust. Call the person. Open the company's known portal yourself. Start a fresh chat instead of replying to the message.

Twenty seconds of mild inconvenience is cheaper than explaining to IT why the CEO apparently needed gift cards at 11:43 p.m.

SPONSORED

Most GTM problems aren’t one big failure. They’re one or two weak spots quietly dragging down the rest.

The free GTM Audit scores your go-to-market across four dimensions, then sequences a 90-day roadmap for your stage.

Drop your URL. Get your score in about 10 minutes.

Get My GTM Score

A training program that employees resent may produce great completion rates and poor behavior. The goal is fewer successful attacks and faster reporting, not a beautiful dashboard showing 100% attendance.

Security teams deserve metrics that measure security.

EMAIL: Congratulations! You've earned a championship ring.

EMPLOYEE: Finally, recognition.

CLICK.

IT: You failed the phishing test.

EMPLOYEE: I have learned something.

IT: Excellent.

EMPLOYEE: Never trust HR.

Good phishing training should make employees harder to fool without making the company harder to trust.

Vote below and tell us the cruelest phishing test you've seen. Bonus points if it involved bonuses.

Technically Friday. Emotionally hovering over every link.

— The Still Monday Desk