The Knicks Phishing Test Did Its Job. That Is the Problem for Houston

The myth: the more people who click, the more the test revealed. NIST built a scale precisely because that reading is wrong.

The fact: a click rate only means something once the email has been rated for difficulty, and the Knicks ring email rates as one of the hardest kinds to refuse. NIST's Phish Scale User Guide (Technical Note 2276, November 2023) says click rates and reporting rates "do not provide a complete picture of an organization's phishing risk; they provide a single point of insight."

The Phish Scale rates an email on two things. The first is cues, the visible mistakes and oddities a reader could notice: 1 to 8 cues counts as Few, 9 to 14 as Some, 15 or more as Many. The second is premise alignment, how well the story in the email fits the people receiving it. NIST scores five elements from 2 to 8 each: whether the email mimics a real workplace process, whether it is relevant to the recipient's work, whether it lines up with a current event, whether it raises concern about the consequences of not clicking, and whether the audience has had training or warnings (that last score is subtracted). A total of 10 or below is Weak alignment, 11 to 17 is Medium, 18 and above is Strong.

Run the ring email through those five elements the way a Houston training implementer would. Ring distribution was a real, active process at MSG Sports, so element one scores near the top. Every recipient was a Knicks employee, so the relevance element scores near the top. The email landed weeks before a televised ring ceremony, so the current-event element scores near the top. Missing out on a championship ring is a real consequence of not clicking. Only the training element pulls the total down, and MSG had just been through a breach, so staff had every reason to be on alert. By CinchOps' reading that lure lands deep in Strong alignment, and on NIST's matrix a Strong-alignment email rates Very Difficult to detect unless it is riddled with 15 or more obvious cues.

That is why the click count proves nothing. NIST writes that "phishing emails that are Very Difficult to detect might understandably result in high click rates," and that the useful signal is the unexpected result, such as a Least Difficult email that still gets clicked. MSG Sports built an email at the top of the difficulty scale, sent it to a workforce that had been promised real rings, and then treated the clicks as failures. A Houston company that does the same with a bonus email or a "your badge photo is ready" lure gets the same hollow number.

The myth: criminals use bonuses and gifts, so a test should too. The record of companies that tried it says otherwise.

The fact: reward lures have embarrassed every large employer that used them, and the training they trigger barely moves behavior. The Knicks episode repeats GoDaddy's December 2020 test, in which an email promised a $650 holiday bonus, about 500 employees failed, and the company apologized and said it needed to "do better and be more sensitive to our employees."

The evidence on what happens after the click is worse than the embarrassment. In an 8-month randomized study of more than 19,500 UC San Diego Health employees across 10 phishing campaigns, presented at the 46th IEEE Symposium on Security and Privacy in 2025, the researchers found no significant relationship between recently completing annual cybersecurity training and falling for a phishing email. The embedded training shown right after a click reduced the chance of clicking by 2%. Three quarters of users spent a minute or less on that training, and one third closed it immediately.

Here is what Houston owners tend to believe a reward lure delivers, set against what the sources above actually show.

The same study shows how much the lure decides the result. A fake update to the vacation policy drew a 30.8% click rate; a fake Outlook password notice drew 1.82%. In the first month, 10% of employees clicked; by the eighth month more than half had clicked at least one link. A company picks its click rate when it picks its lure. Choosing the ring, or the bonus, chooses the highest number available and then presents it as a finding about the staff.

MSG Sports drew the same line itself once the backlash arrived. In a second statement reported by USA TODAY on October 24, the company said that securing its intellectual property and reminding employees to protect it was not the mistake; "the mistake was using the ring as the vehicle." That is the whole argument of this section in the company's own words: the test was fine, the lure was the error, and the lure is the part a Houston owner controls.

Realism is still the goal. The point is where the realism sits. A lookalike vendor invoice, a shared-file notice or a fake DocuSign request mirrors what a Houston construction or engineering office actually receives, carries cues a trained reader can find, and costs nothing in goodwill when the reveal comes. A reward lure mirrors the attacker's cruelty instead of the attacker's tradecraft, and the staff remember the cruelty.

The myth: a failed test plus a mandatory class fixes the person who clicked. MSG's own breach shows which fix was missing.

The fact: the breach MSG Sports cited happened because one phished login and password were enough to get in, and no class fixes that. Have I Been Pwned records the June 2026 incident as a ShinyHunters "pay or leak" extortion campaign in which the published data held almost 10 million unique email addresses across staff and customers, along with names, phone numbers, physical addresses and customer service records.

Read the company's own statement again: the attackers used "an employee login and password obtained through a similar phishing attack." The lesson a security team should draw from that sentence is that a stolen password opened the door. The UC San Diego researchers reached the same conclusion from their 19,500-employee study and recommended two-factor authentication on software and hardware plus password managers that only fill credentials on the correct domain. A password manager will not type a password into a lookalike login page, and multi-factor authentication turns a phished password into a dead end.

For a Houston business the practical order is the reverse of MSG's. Put multi-factor authentication on email and remote access first, put a password manager on every workstation second, and only then run simulations, with the reveal written so that reporting is rewarded and clicking is explained. The test then measures something the business can act on, and the employee who clicks is the person most likely to pick up the phone.

The myth: any lure is fine as long as nobody outside the company sees it. Four questions, and the Houston numbers behind them.

The fact: a lure is safe to send when it passes four questions before it leaves the building, and Houston's industry mix makes the choice matter more here than in most markets. Pistachio's Phishing Behaviour Report 2026, covering 648 organizations and 123,692 users over 12 months, found construction and real estate staff clicked at least once at a 45.74% rate, the worst of any sector, while energy and utilities staff who clicked went on to leak credentials about 46% of the time against 35% to 38% for typical sectors.

Those two sectors are a large share of the Houston payroll, from the engineering and construction offices along the Energy Corridor to the field-services companies in Katy, Cypress and Sugar Land. A workforce that already clicks at the top of the range does not need a lure engineered to push the number higher; it needs lures that look like the invoices, bid documents and shared drawings it handles every day, and a reporting habit it can practice. Across Pistachio's whole cohort the 12-month report rate averaged 21% against a 31% click rate, and on the very first simulation 7.68% of users reported the email while 4.14% clicked. Report rate is the number a Houston owner should put on the wall.

Texas adds a legal reason to get the program right. Texas SB 2610, effective September 1, 2025, shields a business with fewer than 250 employees from exemplary damages after a breach if it maintained a conforming cybersecurity program, and for businesses under 20 employees that program is defined as password policies and training. For a 15-person Katy firm, the phishing program is the safe-harbor program. A test that staff resent, or that a court reads as a stunt, is a weak thing to hold up as evidence that the program was "implemented and maintained" at the time of the breach.

Before any simulated phishing email goes out, CinchOps applies four questions, in this order:

• Would the lure embarrass the company in the newspaper? A ring, a bonus or a raise fails this question before it is written. GoDaddy and MSG Sports both found out in print.
• Does it promise something the company will not deliver? Money, time off and gifts are off the table. A fake invoice or a fake shared file promises nothing.
• Has it been rated on the Phish Scale? Count the cues, score the five alignment elements, and send Least Difficult and Moderately Difficult emails before any Very Difficult one, so the trend has a baseline.
• Is the consequence of a click an explanation or a punishment? If the landing page says "you failed," rewrite it. If the result goes to a manager by name, stop.

A lure that passes all four still teaches. It just teaches the right thing: the invoice from a Sugar Land supplier with a changed bank account, the shared drawing from a familiar name at a public email domain, the DocuSign that arrives the week a contract is actually closing. Those are the emails a Houston business will receive for real, and they are the ones worth practicing on.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

Phishing simulation at CinchOps sits inside the managed cybersecurity service rather than running as a stand-alone stunt: the controls go in first, the lures are rated on the NIST Phish Scale before they go out, and the results are read as a report-rate trend across campaigns instead of a single click count. The service is priced at a flat monthly rate per user, $100 to $250 per user per month, on Zero-Zero-Zero terms: no long-term contracts, no hidden fees, no cancellation penalties.

• Through phishing protection and training, CinchOps builds the lure library from the emails a Houston office actually receives, rates each one on the NIST Phish Scale, and reads the trend by report rate.
• The managed cybersecurity service puts the controls that make a phished password useless, multi-factor authentication and domain-bound password managers, in place before the first simulation, with 24/7 threat monitoring behind them.
• With managed IT support, a reported email reaches a named engineer who knows the client's network, and help desk requests are answered in under 15 minutes.
• On the business continuity and disaster recovery side, immutable, verified backups cover laptops, servers, Microsoft 365 and Google Workspace, so a credential that does get through has less to take.
• CinchOps serves construction, energy services and utilities and engineering firms across Houston, Katy, Sugar Land and Cypress.

If the last phishing test at your company produced a click rate and a list of names, it measured the lure and cost you some trust. The version worth running rates the email first, counts the reports, and puts multi-factor authentication in front of the password the test was fishing for. Talk to CinchOps before the next one goes out.