Key takeaway
Measure a role and department baseline first. Then use short lessons, realistic exercises and immediate coaching, while tracking whether reporting improves.
Aim for safer behaviour, not course completion
A programme should help employees make safer everyday choices: check a sender and link, protect passwords and one-time codes, verify payment changes through another channel, handle information carefully and report suspicious activity. Training complements filtering, MFA, backups and access controls; it does not replace them.
Pause
Do not act immediately on an urgent or unusual request.
Verify
Confirm the sender, address and requested action through a known, separate channel.
Report
Send the message or event through the organisation’s approved security route.
Set a baseline and identify risk groups
Within an agreed training programme, run an exercise that resembles normal work before launching new lessons, without announcing its exact timing to participants. Break results down by department, role and responsibility rather than relying on one organisation-wide rate. Measure clicks, attempts to submit a simulated sign-in form and the share of people who report the message; do not collect real passwords or codes. Use invoice, payroll and employee-data lures for finance and HR; password reset and MFA requests for administrators; repository, cloud-share and key scenarios for technical teams.
Use short lessons, realistic exercises and immediate feedback
Complement an annual course with short lessons throughout the year. Choose current scenarios for each group and make exercises more realistic over time. After a click, immediately explain the warning signs, such as a mismatched domain, manufactured urgency or unexpected attachment, in a non-punitive way. The goal is better judgment next time, not catching people out.
Choose a topic
Use a current threat and a request relevant to the role.
Practise
Use email, QR, text or call scenarios across the channels employees use.
Coach and adjust
Explain the missed signal, then measure behaviour again in the next exercise.
Make reporting straightforward
Employees should know where to send a suspicious message: a mail-client button, security mailbox, service desk process or incident portal. Introduce the route during onboarding, and check whether reports reach the right queue as well as counting clicks. Encourage prompt reporting after an accidental click so responders can protect the account and look for related messages.
Measure behaviour over time
Compare later rounds with the baseline using a similar audience and comparable difficulty. Review click rate alongside report rate, time to report, repeat clicks and reporting of real events. Break the results down by department and watch the direction across several cycles rather than one spike. Name a programme owner, secure leadership support for ongoing work, and review trends and open actions together. If clicks do not fall, review relevance, the reporting route and risky work processes before assigning another generic video.
| Measure | What it tells you |
|---|---|
| Click / simulated form submission | How often the exercise triggered a risky action |
| Report rate and time | Whether employees report threats and how quickly |
| Repeat patterns and department trend | Where targeted coaching or a workflow change may help |
Example: a supplier invoice change
A finance employee receives an invoice with new bank details in an existing supplier thread. Instead of calling a number in the email, they verify the change using the supplier number already on file, report the message through the approved route and obtain the second approval required by the payment process. A short exercise lets the finance team practise the checks; the programme measures both verification and reporting.