Posting from real account now
I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain cybersecurity metrics. As I understand and was told to me by management reporting directly to CISO, these are to be used mainly for internal operational process improvement, not to point fingers at anyone or call individuals out for weaknesses in their role.
Today, I received request from senior management for individuals who have been demonstrating weaknesses in phishing reporting and recognition of malicious emails. I understand management having these names will help in assessing what our social engineering risk exposure is, but feel it's unnecessary and eroding trust with other employees. The folks may think this is a back stab and request feels unreasonable to me.
From my prior work experience in cybersecurity, building trust with end users is critical to achieving business goals. I am a respected senior member of the team and given considerable leeway in making decisions.
Edit to incorporate responses to comments:
@ThursdaysGeek, we do "additional training" for users who consistently have issues via in person followup now. Either I or a colleague would work with the end user directly. For high value whales (i.e: Executives and senior management), SecOps manager communicates with them.
@JcMack - All employees are required to complete annual security training. If not completed, then before end of year, access to company IT resources for non - compliance folks is removed. Clickers in the past have shown certain trends and the types of employees having these issues is rather expected.
If there are fellow security practitioners on here, I would love to hear what you did if you faced a similar circumstance before. Specifically:
If targeted training were to be implemented, how would you learn what social engineering exploits are in the wild now?
How would such targeted exercises work? We already have top management buy in (CISO)
Is my belief that requested data is unnecessary reasonable?
How can I balance fulfilling my duty in my role, to protect company assets, against supporting my fellow colleagues in this situation?
If offering management anonymized data is appropriate, how can I best make this request professionally?