Binance runs monthly phishing tests on employees, warns of dismissal for repeat failures

Most companies send their employees a yearly compliance training video and call it a day. Binance sends fake phishing emails every month, and if you keep falling for them, you’re out. The world’s largest crypto exchange has been running an internal red team operation that conducts simulated phishing attacks on its own workforce. The program has been active for more than three years, and according to Chief Security Officer Jimmy Su, it has meaningfully improved the company’s “security hygiene.” For an exchange sitting on roughly $137.7 billion in assets under management and serving 323 million registered users, that hygiene matters quite a bit. How the program works Binance’s red team designs scenarios that mirror real-world social engineering tactics. Think fake job recruiter messages, too-good-to-be-true conference invitations, and other lures designed to trick employees into revealing sensitive information or clicking malicious links. Employees who take the bait don’t get a slap on the wrist and a “better luck next time.” They’re put through remedial training. Repeated failures start affecting performance ratings. And at the far end of the consequence spectrum, chronic offenders ...