Most breaches start with somebody clicking something. Training works when it is short, frequent and measured, and fails when it is an hour-long video watched once a year with the sound off.

Start by measuring, not teaching

A baseline phishing simulation runs before any training, so you know your real click rate rather than an industry average. It is unpleasant reading in most organisations, and it is the number every later result is compared against.

Training people will actually finish

Short modules, monthly, aimed at the mistakes your baseline showed. Somebody who fell for an invoice lure gets content about invoice lures. Nobody sits through a module on a threat their role never meets.

Reporting a board can use

Click rate by user over time, who has completed what, and policy attestations recorded against names. That is the evidence your insurer asks for, and it is also how you tell whether the programme is working.

Common questions

Do you name people who fail?

Yes, in the executive report, and anyone who clicks is enrolled in follow-up training automatically. The naming exists to route people to the right coaching, not to build a case against them. Where results get used for discipline, people stop reporting the incidents that matter, which costs you far more than the click did.