Why most programmes underperform
A yearly video and a quiz satisfy an audit checkbox but rarely change what people do on a busy Tuesday afternoon. Effective programmes are continuous, relevant and measured by behaviour.
Principles that work
Make it role-based
Finance teams need deep training on invoice and payment-change fraud. Developers need secure coding. Executives are targeted for impersonation. HR handles sensitive personal data. One generic course cannot cover all of this.
Short and frequent beats long and annual
Five-minute modules monthly keep security top of mind without overwhelming people.
Use realistic simulations
Phishing simulations should mirror real lures your organisation sees — supplier invoices, delivery notices, shared documents — and increase difficulty over time.
Reward reporting, not just avoiding clicks
The most valuable behaviour is reporting suspicious messages quickly. Make reporting one click and thank people when they do it.
Never shame
Public naming or punitive responses discourage reporting — the opposite of what you want.
Building the programme
- Baseline: run an initial simulation and short knowledge survey
- Identify high-risk roles and tailor content
- Schedule monthly micro-learning and simulations
- Provide just-in-time training when someone clicks
- Share results and real incidents (anonymised) with staff
- Brief executives and the board separately on targeted threats
Metrics that matter
| Metric | Why it matters |
|---|---|
| Report rate | Shows active defenders, not just avoidance |
| Time to first report | Faster reports mean faster containment |
| Repeat clickers | Identifies people needing support |
| Click rate trend | Useful, but only alongside reporting |
Completion rates show compliance, not effectiveness.
Compliance links
Frameworks such as ISO 27001 (people controls), RBI and SEBI expectations and the DPDP Act all assume staff understand their responsibilities. A well-run programme supplies that evidence naturally.
Key takeaways
- Make training role-based, short and frequent.
- Reward reporting and never shame people who click.
- Track report rate and time to report, not only completion.
Frequently asked questions
How often should we run phishing simulations?
Monthly or bi-monthly works for most organisations, with varied scenarios and gradually increasing difficulty.
Should executives be included?
Yes. Executives and their assistants are prime targets for impersonation and need tailored briefings.
What is a good report rate?
Trends matter more than a single number — the goal is a steadily rising share of employees who report simulated and real phishing quickly.
People are not the weakest link when they are trained to be the first alert.
Explore our security awareness programmes.
