I work in tech support for a large corporate office that has a lot of overpaid managers who know nothing about technology. A high-priority ticket pops up on my screen. They’re all high-priority, because that’s how senior managers see themselves. This one has come from one of the many directors:
Subject Line: “URGENT: My computer is broken!”
I sigh and remote into his machine. Sure enough, he’s clicked on a phishing email from something called “MicroSofte Security Alert Team.” Classic. It’s getting pop-ups and warnings of viruses and whatnot.
I call him directly.
Me: “Hey, [Director], I see your computer’s having issues.”
Director: “No s***, Sherlock! I need it fixed right now or—”
Me: “I’ve just locked your account.”
Director: “…You what?!”
Me: “You clicked a fake security link. That’s a breach. I need to make sure you didn’t just let a virus into the company network.”
He’s already raising his voice.
Director: “I’m a department head. You can’t just shut down my computer without authorization!”
Me: “Actually, I can. It’s called preventing a company-wide ransomware attack. You’re welcome.”
He hangs up on me. Twenty minutes later, I get a Teams message from HR. They’re calling an “urgent meeting.” As in right now. The director’s already there, practically vibrating with indignation.
Director: “This IT guy shut down my access and accused me of a security breach!”
Me: “Not accused. Confirmed. You clicked a phishing link that could’ve compromised the company.”
HR: “Let’s keep this professional.”
Me: “I am being professional. That’s why I didn’t let the malware finish downloading.”
The director glares.
Director: “You overstepped. I’m a director. I make operational decisions.”
Me: “And I make cybersecurity ones. You clicked something that said ‘Microsofte’ with an extra e. That’s not operational. That’s educational.”
HR: “[Director], IT has authority over security protocol.”
The HR person then turns to me.
HR: “Uh… what is the protocol?”
Me: “He’ll need to take the cyber-awareness course before his account is reinstated.”
Director: “You’ve got to be kidding me! I don’t have time for that nonsense!”
Me: “Next time, think about that before you click a fake link.”
He storms out, saying he’s going to take this up with the company president. Another hour goes by, and another “urgent meeting”, this time in the president’s office.
The company president is sitting there looking half-amused, half-tired. The Director is sitting opposite him, looking like a sulking teenager.
President: “So, [Director] tells me you locked him out of his system without clearance?”
Me: “He clicked a phishing link from a known scam domain. I followed standard incident response. I didn’t need clearance.”
President: “Director, did you click the link?”
Director: “It looked official!”
President: “But did you click it?”
Director: “I… yes.”
The president leans back and rubs his temple.
President: “So, he prevented a breach that you caused?”
The director is sullen and silent.
President: “Alright, here’s how this works. You’ll complete the cybersecurity course. That takes a day. IT will run diagnostics on your workstation, and until they say you’re clean, you’re not logging in. Understood?”
Director: “This is ridiculous.”
President: “No, what’s ridiculous is that our Operations Director doesn’t recognize a phishing scam.”
The Director mumbles and leaves. The President turns to me.
President: “Good work. Next time, if anyone else in upper management clicks something stupid, just shut it down and send me an email. I’ll handle the fallout.”
Me: “Gladly. In fact, I already have that template drafted.”
President: “You IT people scare me.”
Me: “Good. That means it’s working.”