Security Awareness Training
Phishing and impersonation campaigns for all staff
Everyone in the organisation learns the habit of doubting a suspicious message first and reporting it straight away.
Realistic phishing emails and impersonation by text, messenger and phone go out in rounds, each followed by a short look back.
When a suspicious message arrives, do our staff stop to doubt it and report it?
The report rate and the time to the first report for each round, how they change, and what the next round should focus on.
Reviewed
When it fits
- Staff click links without a second thought
If people click links in phishing emails without thinking, let them meet it first in a safe campaign, before a real attack does.
- The annual training video changes nothing
If a video and a quiz have not changed behaviour, receiving a realistic message and looking back at that round works better.
- Impersonation has already reached you
If impersonation emails or payment requests in the chief executive's name have come in, the next round includes situations like them, so staff practise spotting and reporting them.
- You need to show the effect in numbers
You want to report to leadership how the report rate and the time to the first report changed from round to round.
The SAFE SQUARE approach
Measured round by round
Each round we measure the report rate and the time to the first report, to show how far the training has really changed behaviour.
Messages like the ones you really get
Scenarios by email, text, messenger and phone are chosen to fit your sector, your work and the impersonation you have recently received, and change from round to round. Impersonation found by Phishing & Impersonation Analysis can go straight into them.
Following reports to where they land
We also check that each report reaches the security team promptly and is acted on.
What a campaign includes
For each round we set the following to fit your organisation and its work.
- Channels
Phishing email, text, messenger and phone impersonation, chosen and mixed to fit the organisation.
- Situations
Situations people really do meet, such as delivery or payment notices, account checks and requests in the name of the chief executive or a supplier, chosen to fit the work.
- Reporting route
Where and how people report a suspicious message, and whether the report button or address is actually used.
- A short look back
After each round, a short session on where in that round's messages the signs were.
- What we measure
The report rate, the time to the first report, and the share who clicked or entered details, round by round.
How it runs
Set the audience and rounds
Which teams take part, how many rounds over what period, how reporting works, and how the results will be handled.
Prepare the scenarios
Messages and scenarios for each round are prepared, and the sending set-up and timing are agreed with your security and IT staff.
Run the round
The messages go out, and reports, responses and how long reports take to reach the security team are recorded.
Look back, plan the next
The round's results are written up and turned into a short look back, and the situations for the next round are chosen.
Sending times, recipients and a point of contact are set in advance, so campaigns stay clearly apart from real work.
What you receive
Report rate and timing by round
The report rate and the time to the first report for each round, compared with the round before.
Differences by team and channel
Where messages were hardest to spot, by team and by channel, and so where the next round should focus.
How the reporting route held up
How long reports took to reach the security team, and where they got stuck on the way.
The next round
Suggested situations and look-back topics for the next round.
A suspicious message reaches the security team within 30 minutes of being sent
Scope: 600 staff, two email and text campaigns three months apart
| Measure | Result | Round 1 → round 2 |
|---|---|---|
| Report rate | Better | Up from 8% to 27%. |
| Time to the first report | Better | Down from 47 minutes to 9. |
| Share who entered details | Better | Down from 6% to 2%. |
| Impersonation by text | Needs work | Reported far less than email; many said they did not know where to report a text. |
| Reports reaching the security team | Needs work | The report mailbox was checked only in working hours, so evening reports waited until the next morning. |
- Summary
- Impersonation by email is now reported sooner and by more people. Impersonation by text, and reports made out of hours, still reach the security team late.
- Next round
- Round 3 focuses on impersonation by text, with the place to report texts explained beforehand. The report mailbox gets an out-of-hours alert.