implementing-anti-phishing-training-program

Start by running a baseline phishing simulation across all departments to measure current click, submit, and report rates. Use that data to identify high-risk roles, then deploy role-based training and monthly simulations with progressive difficulty.

Track report rate and time-to-report as primary outcomes, not just click rate. A low click rate with near-zero reporting means users stay silent rather than safe. Measure the same cohort over time against a pre-training baseline.

Both platforms support automated enrollment, simulation campaigns, and reporting dashboards, and this Skill's workflow applies to either. Cofense PhishMe is another option; choose based on LMS integration needs and existing security stack.

Common causes include simulations that are too easy or uniform, simulation mail being allowlisted so users never see the lure, and punitive culture suppressing reporting. Vary lure types and difficulty, and verify simulations actually land in inboxes.

Run monthly simulations with varied scenarios including links, attachments, QR codes, and BEC. Increase difficulty based on organizational performance, and re-test trained cohorts 30-60 days after training to verify improvement.