Build a reporting habit without making employees the problem.
Use a controlled, approved exercise to practise recognition, reporting, and response—then turn measured learning into agreed safeguards and respectful follow-up.
Treat reporting as a skill people can practise
When employees report a suspicious message promptly, the security and support teams have a clearer opportunity to review it and follow the approved response path. A controlled exercise can help people practise that behaviour and help the organization see whether reporting, triage, escalation, and communications work together.
Protect dignity while the organization learns
The exercise is planned with authorized stakeholders. Before anything is sent, the scope defines the audience, scenario boundaries, reporting route, data handling, who may see individual-level information, employee communications, support contacts, and follow-up. The goal is learning and improvement, not public identification, humiliation, or a test of personal worth.
Measure only what the exercise can show
- Delivery and interaction patterns
- Use of the approved reporting path
- Response coordination and follow-through
- Themes that need clearer guidance or technical safeguards
Results are reviewed in context and translated into an agreed, non-punitive improvement plan with responsible parties. A simulation does not measure every aspect of employee judgment, predict an individual’s future behaviour, or prove that future phishing attempts will be recognized, reported, or stopped.
Practice that produces a usable next step
The exercise should strengthen a reporting habit and the organization's response—not rank people or predict who will make a future mistake.
Agree on safeguards before sending anything
Employees should not have to absorb avoidable fear, embarrassment, or unclear data use for the organization to learn.
Agree on purpose and safeguards
Authorized stakeholders confirm the learning goal, audience, approvals, scenario boundaries, reporting path, data handling, individual-level access, communications, and support contacts.
Run the exercise
The assigned specialist delivers the approved simulation, monitors only the agreed measures, and follows the approved escalation and support path.
Learn and improve
Review results in context, reinforce the reporting path, and agree on non-punitive improvements to guidance, workflow, response coordination, or technical safeguards.
Questions to resolve before you proceed
Use these answers to identify what must be confirmed in the proposal and agreement for your environment.
Will individual employees be publicly identified?
Campaign design should avoid public shaming. Individual-level handling, if required, must be agreed with authorized stakeholders and appropriate policies.
Does a good result prove employees will stop every attempt?
No. A simulation measures selected behaviours in one controlled exercise. It does not predict an individual's future decisions or prove that every attempt will be recognized, reported, or stopped.
Can we practise the internal response too?
Yes. The exercise can include the approved reporting route, triage, escalation, communications, and follow-up.