Binance tests its own employees monthly with fake phishing

Binance tests its own employees every month with simulated phishing attacks to keep security awareness within the company up to standard. Anyone who repeatedly falls for them risks not only a lower performance rating but also dismissal. That is according to Jimmy Su, chief security officer at Binance, in a conversation with Cointelegraph.

Internal red team behind the attacks

The simulated attacks are carried out by Binance’s internal red team, an ethical hacking unit that pressures systems and staff to uncover vulnerabilities. The team has been working in this way for three to four years and uses realistic scenarios such as fake job openings, invitations to free conferences and attempts to extract personal data.

“We conduct phishing attacks on our own employees every month, purely to see whether our security culture is improving,” says Su. That may sound strict, but the aim is preventative: the company does not want to wait until real attackers find an opening through an unwary employee. The approach fits the broader trend in which major crypto companies are increasingly investing in internal security, partly due to the rise in hacks and attacks in the crypto sector.

Consequences for those who fail

Employees who fail to recognise a simulated attack are required to take remedial training. That is still relatively mild for a first offence, but those who consistently fail face serious consequences. Repeated failures are factored into performance reviews and can ultimately lead to dismissal.

Binance is meanwhile growing rapidly on several fronts. For example, the company dominates the ETF perpetual market with a 74% market share. The larger the company becomes, the more attractive a target it is for malicious actors, which only makes the monthly phishing tests more relevant. With this programme, Binance shows that security is not only a technical issue, but also a human one.