Phishing Awareness Training for Employees: 2 Case Studies on What Changes Employee Behavior

Key takeaways

• A case study counts as evidence only when its method is visible. Organization, sample, lure, intervention, baseline, comparison group, outcome definitions, and follow-up period all belong in the write-up.
• Personalization changed click behavior sharply in the Italian hospital study. A customized lure drew a 55% click rate against 7% for a generic message.
• Annual training did not predict safer behavior. The randomized UC San Diego Health study found no significant link between recent training completion and simulated phishing failure.
• Click rate alone overstates progress. Reporting rate, time to report, credential submission, and repeat failure give a fuller picture of human risk.
• Ethical design protects the program. Governance, proportionate lures, privacy limits, help desk capacity, and coaching keep simulations from damaging employee trust.

Want more from Adaptive in your Google results?

Phishing awareness training for employees teaches people to recognize, report, and contain deceptive messages before a click becomes credential theft, payment fraud, or a malware incident. This guide helps security and IT leaders judge whether a case study demonstrates real behavior change or only a lower simulated click rate.

Two studies anchor the comparison. A 2022 peer-reviewed Italian hospital study tested customized phishing emails against generic ones. A randomized UC San Diego Health study followed more than 19,500 employees across eight months. The two differ in intervention, outcome definitions, follow-up period, and operational burden.

This guide also covers how to design ethical phishing simulations across email, SMS, voice, QR codes, and collaboration tools. It connects employee training to MFA, password managers, filtering, and incident response, so human judgment and technical controls are measured together.

Neither study settles the question alone. The Italian study shows how personalization, fatigue, filtering changes, and workforce concerns shape results. The UC San Diego study tests annual training against embedded point-of-failure feedback. Reporting rate, time to report, credential submission, repeat failure, and real-incident outcomes all belong alongside click rate.

Security leaders who want to see how those measurements fit a running program can review Adaptive Security's approach to human risk monitoring.

What do Phishing Awareness Training Case Studies Prove?

Phishing awareness training for employees teaches people to recognize and report deceptive messages before they disclose information, approve payments or execute harmful instructions. A program built around that training should measure behavior against phishing, spear phishing, and business email compromise (BEC), because a completion record cannot show that behavior.

A credible case study demonstrates whether a defined intervention changed a defined behavior over time. A customer success story often highlights favorable results without enough methodology to test the claim, so readers should ask for the missing detail.

What Separates a Case Study From a Vendor Success Story?

A credible case study makes the evaluation visible. It identifies the organization and sample, describes the threat scenario, explains the intervention, reports a baseline, defines the comparison group and states how outcomes were measured. It also gives the follow-up period and addresses confounding factors such as concurrent security campaigns, staff turnover, seasonal workload and changes in email filtering.

A vendor success story often compresses this evidence into a before-and-after number. "Click rates fell" sounds persuasive. The figure stays incomplete unless readers know whether the same employees were measured, whether the emails had comparable difficulty, whether reporting behavior improved and whether the result lasted beyond the campaign.

A lower click rate can reflect a less convincing simulation as easily as stronger employee judgment. Case studies that omit message difficulty leave readers unable to tell those two explanations apart.

A stronger evidence standard comes from an eight-month randomized controlled experiment involving more than 19,500 employees at a large healthcare organization. The 2025 IEEE Symposium on Security and Privacy study of phishing training analyzed repeated simulated phishing campaigns. It separated training exposure from other factors that influence employee behavior.

That design provides a more useful benchmark than an unnamed customer quote or an isolated simulation result, because it tests performance across time and across repeated scenarios.

Even that standard has limits. A randomized study can isolate the effect of the tested intervention, but it cannot rule out every outside influence when employees also encounter new policies, security controls or workplace conditions. Readers should treat the findings as evidence about susceptibility and retention, then ask whether the intervention produced durable improvement in later tests.

What Should a Phishing Training Evaluation Measure?

A useful evaluation begins with the organization and sample. Readers should know the industry, approximate workforce size, participating departments, job roles and whether the sample included clinicians, administrators, contractors or executives. A hospital-wide result can conceal sharply different exposure patterns between a billing team, a nursing unit and an information technology department.

The threat scenario must be equally specific. A generic password-reset email tests a different instinct from a spear phishing message built around a known supplier, a fake payroll notice or a BEC request from a senior executive. The study should identify the channel, lure, sender profile, requested action, data sought and level of personalization, without publishing details that would enable misuse.

The evaluation should describe the intervention and what employees actually received. Phishing education explains warning signs and reporting steps. Annual cybersecurity awareness training delivers a periodic curriculum covering phishing, passwords, data handling and policy obligations.

Embedded training places instruction close to the risky action, such as a short lesson after a user clicks a simulated message. Simulated phishing sends controlled decoys to observe behavior in a safe environment. These approaches can work together, although they remain distinct, and a case study must name which one it evaluated.

Baseline and comparison group design determine whether the outcome means anything. A baseline records behavior before the intervention. A comparison group can consist of employees who receive a different training approach, a different message type or a later intervention.

Without one of those reference points, a post-training click rate cannot show improvement. Researchers should also report whether the same people took part in each round, whether campaign timing stayed consistent and whether employees knew the exercise was underway.

Outcome definitions must go beyond clicks. A click can mean that a person opened a landing page, entered credentials, downloaded a file or selected a link before recognizing the simulation. Those are different levels of exposure.

Strong evaluations separately report open rate, click rate, credential-submission rate, attachment execution, report rate, time to report and repeat behavior. They should also state the denominator for each metric. A reported click percentage carries little meaning if the study never says whether the calculation used delivered messages, opened messages or participating employees.

Follow-up determines whether the result represents behavioral change or a short-lived reaction. Immediate post-training performance shows whether employees understood the lesson. A later simulation tests retention.

Multiple campaigns across several months reveal whether employees apply the skill when the lure, channel or workload changes. A training program that lowers clicks in one exercise while producing no increase in reporting has not demonstrated complete behavior change.

Accounting for confounding factors keeps a study from crediting training for changes caused by something else. A study should disclose changes to email filtering, password policies, multifactor authentication, reporting buttons, incident-response procedures and staffing. It should explain whether employees received other security messages during the measurement period.

Eliminating every real-world influence is rarely possible. The realistic goal is to identify the influences that could explain the outcome independently of training.

Security leaders evaluating platforms should apply the same discipline when reviewing phishing simulation methods. The relevant question is broader than whether a tool can produce a difficult email. What matters is whether the program connects realistic scenarios to instruction, reporting and repeated measurement across the channels employees actually use.

Why Does Click Rate Alone Fail as Proof of Behavior Change?

Click rate is useful because it captures one observable decision, although it remains an incomplete measure of human risk. A falling rate can indicate that employees recognized the lure. It can also result from predictable templates, advance warning, technical blocking or a sample that changed between campaigns.

A rising report rate provides stronger evidence that employees know what to do once suspicion begins, especially when analysts verify whether reports arrive quickly and accurately.

The opposite mistake is also common. A click does not prove that training failed. An employee may click, recognize the suspicious page, close it and report the message. That event still deserves remediation, although it differs from entering credentials or authorizing a payment. Case studies should separate unsafe exposure from completed compromise behavior and report the entire decision path.

What Types of Phishing Should Employees Recognize?

What Is Phishing?

Phishing is a social engineering attack that impersonates a trusted sender or service to make a target reveal information, open harmful content or take an unauthorized action. Email remains a common delivery route. Effective awareness training teaches employees to verify requests across every communication channel.

What Is Spear Phishing?

Spear phishing is a targeted phishing attack tailored to a specific person, team or organization. Cyberattackers use open-source intelligence (OSINT), such as public job details or supplier relationships, to make the message fit the recipient's work. Personalization increases plausibility, so simulations should test whether employees verify context, because spelling errors are no longer a reliable tell.

What Is Business Email Compromise?

Business email compromise (BEC) is fraud that uses a trusted business identity or conversation to trigger a payment, payroll change, data transfer or credential disclosure. The message can come from a compromised account, a lookalike domain or an impersonated executive. Employees need a separate verification process for high-impact requests, because a technically clean message can still be fraudulent.

What Is Smishing?

Smishing is phishing delivered through a text message or another mobile messaging service. It often uses delivery notices, account warnings, one-time-code requests or urgent links. Training should teach employees to avoid using contact details supplied in the message when they verify the request independently.

What Is Vishing?

Vishing is voice phishing conducted through a phone call, voicemail or voice-enabled platform. A caller may impersonate a bank, colleague, help desk or executive and use urgency to suppress verification. Employees should pause, end the call when necessary and reconnect through a trusted number.

What Is Quishing?

Quishing is phishing delivered through a QR code. The code can redirect a phone to a counterfeit login page while bypassing the visual inspection people apply to ordinary URLs. Employees should treat unexpected QR codes as links and preview the decoded address before opening it.

What Is Whaling?

Whaling is a phishing attack aimed at senior executives or other high-value decision-makers. It commonly seeks wire transfers, confidential documents or access to strategic accounts. Executive assistants, finance personnel and legal teams also require training, because cyberattackers often target the people who can execute an executive's request.

What Minimum Disclosures Should a Case Study Provide?

A reader should expect these details before treating a result as evidence:

• Organization and sample: Industry, workforce size, participating roles, sample size and attrition.
• Threat scenario: Channel, lure, personalization, requested action and message difficulty.
• Intervention: Education, annual training, embedded lesson, simulated phishing or a combination.
• Baseline and comparison: Pre-intervention measure, comparison group, repeated-measures design and denominator.
• Outcome definitions: Clicks, submissions, reports, reporting speed, repeat behavior and confirmed incidents.
• Follow-up period: Immediate result, later retest and total observation window.
• Confounding controls: Filtering changes, policy updates, concurrent campaigns, staffing shifts and technical controls.

These disclosures keep a case study tied to observable decisions instead of attractive but incomplete percentages. The Italian hospital study shows why, because it tested whether message personalization changes employee behavior.

What Did an Italian Hospital's Phishing Awareness Training Reveal?

Phishing awareness training for employees becomes harder to design when the most effective test also creates operational and ethical risk. In one Italian hospital, customized phishing emails dramatically outperformed generic lures. The same campaign exposed hidden costs involving workload, help desk capacity, mobile interfaces, employee trust, union relations and management oversight.

The case shows that personalization can reveal human-risk signals. Only responsible governance turns those signals into safer behavior.

Context and Research Design

The case involved a major Italian hospital with more than 1,500 beds and more than 6,000 employees. The hospital already required online cybersecurity training and had technical controls in place, although its internal project team identified low confidence in employees' ability to recognize phishing.

The concern had a basis in experience. The hospital had previously received a whaling attempt in which a cyberattacker impersonated the hospital director and asked the head of purchasing to transfer money.

The hospital worked with an external consultancy on a yearlong phishing simulation that served as both a risk assessment and a training exercise. The plan called for three campaigns at roughly four-month intervals. Staff received either a generic message commonly used by the consultancy or a customized message based on current hospital circumstances.

The study did not track individuals across campaigns. Senior administrative and academic leaders were excluded because they knew about the exercise.

The Italian hospital phishing simulation case study, published in 2022, reported that 5,313 staff received messages in the first campaign, 2,700 received the second and 5,198 received the third. Researchers measured whether recipients opened the messages and clicked embedded links. Clicks were recorded accurately, although open rates could be undercounted because tracking mechanisms cannot detect every open.

The first campaign split 2,656 employees into a generic group and 2,657 into a customized group. The generic message claimed that a Microsoft email about pay scales had been quarantined and asked recipients to click a link and enter a password to release it. It came from an unfamiliar external domain, used poor grammar and displayed its content as an image.

The customized message used a credible workplace context. It told employees they had 48 hours to complete mandatory online training and directed them to a link that appeared to begin the course. The sender address and grammatical errors still offered warning signs, although the subject aligned with a real hospital obligation. That connection made the message more relevant and more persuasive.

The first campaign produced a stark contrast. The generic email generated a 7% click rate, while the customized email generated a 55% click rate. Among recorded opens, 18% clicked the generic link and 88% clicked the customized link, although open counts are likely understated.

The customized message also attracted more attention at the opening stage, with 62% opening it compared with 36% for the generic message. Those results show how a familiar administrative context can make a phishing email more persuasive than an obviously suspicious password request.

The findings matter for healthcare because a message that fits an active hospital task can succeed even where staff already complete required training. The customized message fit an active hospital task, reduced the psychological distance between the message and daily work, and created a credible reason to act quickly.

A generic password request looked like an external nuisance. A message about mandatory training looked like an internal administrative request, and the later Christmas bonus message followed the same pattern.

Click rates still require context. The hospital did not identify individual employees, so researchers could not determine whether the same people clicked repeatedly or whether the same individuals appeared in more than one campaign.

The groups also changed across the year, while the COVID-19 pandemic altered workloads, staffing patterns and communication demands. The 2022 case study describes how this hospital responded to these messages. It does not describe how every healthcare organization would respond.

What Did the Fake Christmas Bonus Campaign Reveal?

The second campaign used a fake Christmas bonus because rewards create a different pressure from compliance reminders. The customized email said a bonus would be paid on Dec. 18 but had to be claimed through the link. It contained no obvious grammatical errors and arrived when employees could reasonably expect year-end compensation communications.

The Christmas bonus campaign also triggered an immediate organizational reaction. Employees asked labor unions for an explanation after receiving the message. The unions asked management to stop the campaign because no bonus existed and argued that the deception created confusion and disappointment. Management stopped the planned generic comparison message, leaving the second campaign incomplete.

That decision changed the study design and demonstrated that a simulation can become an employment-relations event. A lure that appears realistic to a security team can feel manipulative to employees, particularly when it invokes compensation. Healthcare staff already manage time pressure, fatigue and patient-care demands, so a simulation that creates anxiety can impose costs the click rate never records.

What Were the Operational and Ethical Consequences?

The hospital's technical defenses changed the later results. Before the second campaign, an antivirus upgrade sent 1,600 of the 2,700 customized emails directly to junk mail. Of all messages sent, 21% produced a click in the second campaign, compared with 55% in the first customized campaign. Among messages that reached inboxes, the click rate was 51%, and among opened messages it was 87%.

The third campaign used a blended message that was neither purely generic nor fully customized. It offered a free Dropbox upgrade in recognition of employees' support during COVID-19, used a more generic sender address and displayed the message as an image. All 5,198 recipients received the same version. The blended campaign produced a 3% click rate, compared with 7% for the first generic message.

The lower rates cannot be attributed to training alone. The upgraded spam filter diverted a substantial share of the second campaign. The third message used different content and sender details, and some employees had already received feedback about phishing.

The 2022 case study found a significant reduction in click rates between the first campaign and the later ones. It could not isolate the effects of awareness training, repeated exposure, filtering, message difficulty or changing workplace conditions.

The campaign also exposed the hidden workload of a large simulation. Employees asked questions, managers responded to confusion, unions demanded clarification and the help desk absorbed a sharp increase in alerts. A help desk that is not briefed in advance can become overloaded precisely when the exercise is meant to strengthen reporting behavior.

Preparing additional staff, creating response scripts and coordinating escalation paths should be part of the phishing simulation program from the beginning. None of it works as an improvised response.

Mobile interfaces created another concern. On smartphones, the full sender address and destination URL can be obscured, and employees cannot hover over a link as they can on a desktop. The study did not measure which platform employees used, so it could not quantify the effect.

The study did identify mobile display limitations as a reason to treat desktop inspection habits as an insufficient basis for phishing awareness training for employees.

The ethical response starts with cross-functional planning. Before launching a customized campaign, management should involve HR, legal counsel, privacy officers, unions, security leadership, training owners and the help desk. That group should define the data collected, access permissions, reporting method, unacceptable messages and feedback process.

Individual identities should remain private when the objective is organizational risk assessment. Discipline is a separate process with separate safeguards.

Management also needs a clear balance between transparency and realism. Employees should understand why simulations occur, what is monitored and what consequences do not follow from clicking. Communicate those boundaries before launch without disclosing the exact timing, sender or lure.

A small pilot can test whether a message creates disproportionate distress or operational disruption while preserving the integrity of the broader exercise.

The study does not show that customized emails should replace generic ones. It shows that effective healthcare phishing awareness training must test the threats employees actually face, including role-specific requests and current workplace events. The design must also respect the conditions in which healthcare staff work.

Generic messages can measure recognition of obvious phishing. Customized messages test whether employees pause when a request fits their responsibilities, relationships or immediate incentives.

A responsible program treats employees as participants in defense, which rules out anything designed to embarrass them. Limit campaign frequency, rule out deceptive claims about pay or job security, prepare the help desk, protect privacy and report aggregate findings transparently.

The Italian hospital experience shows that personalization can expose a serious human-risk signal. Cross-functional planning determines whether that signal becomes safer behavior or damaged trust.

What Did the UC San Diego Health Study Reveal About Phishing Awareness Training for Employees?

Annual training and embedded point of failure training did not materially reduce phishing failures in a randomized study at UC San Diego Health. Across 10 simulated campaigns over eight months, annual training showed no significant relationship with safer behavior.

Embedded point-of-failure training lowered the aggregate failure rate by only 1.7 percentage points, according to the 2025 IEEE Symposium on Security and Privacy study. That result does not prove that all training fails. It shows that short, generic interventions delivered after a simulated mistake cannot carry an organization's phishing defense alone.

How Was the UC San Diego Health Study Designed?

The study compared two common approaches to phishing awareness training. The first was annual, mandatory cybersecurity training that employees completed independently of a phishing event. The second was embedded training delivered immediately after a participant clicked a link in a simulated phishing email.

Researchers randomized employees across training conditions and phishing lures. A simple comparison of employees who completed training with those who did not would have been weaker, because voluntary completion, job role, technical familiarity and prior security experience can distort observational results. The experiment tested whether the timing and delivery of training changed behavior under controlled conditions.

Over eight months, the research team sent 10 simulated phishing campaigns to more than 19,500 UC San Diego Health employees. The lures varied in subject, pretext and apparent urgency, creating a more realistic test than one repeated password-reset email. Researchers measured whether employees clicked and whether those who received embedded training behaved differently in later campaigns.

The study is valuable because it examined training in a working healthcare environment across eight months, far longer than a short laboratory exercise. Healthcare organizations operate under intense workload pressure, handle sensitive data and depend on rapid access to clinical and administrative systems.

Those conditions make the findings relevant to security leaders assessing whether annual training and automated just-in-time lessons produce durable behavior change.

The research team included Grant Ho, a University of Chicago faculty member, and Ariana Mirian, a senior security researcher at Censys. UC San Diego researchers Stefan Savage and Geoffrey M. Voelker also took part, alongside clinical co-authors from UC San Diego Health.

The authors wrote that "anti-phishing training programs, in their current and commonly deployed forms, are unlikely to offer significant practical value in reducing phishing risks." That conclusion applies to the tested formats and leaves other possible training designs untested.

What Is Embedded Point-of-Failure Training?

Embedded point-of-failure training appears after an employee interacts with a simulated phishing message. The participant clicks the link, the expected destination does not load, and a training page explains the warning signs. The reasoning behind it is straightforward: deliver instruction at the exact moment of failure, when the employee has a concrete example in front of them.

The UC San Diego Health study found that timing did not guarantee attention. In more than 75% of embedded training sessions, users spent a minute or less on the material, and between 37% and 51% of sessions across the study conditions recorded no time on the training page at all.

A training page can exist in the workflow without creating meaningful learning. Exposure differs from comprehension, and comprehension differs from behavior that persists under pressure.

Grant Ho, a study coauthor and University of Chicago faculty member, told UC San Diego Today that limited engagement was one reason the intervention produced little measurable change. The operational lesson is straightforward. A point-of-failure prompt must be concise enough to earn attention, specific enough to correct the mistaken judgment and reinforced later through realistic practice.

The study did not test why employees disengaged. Competing workload is one plausible explanation, but the researchers did not measure it. A clinician, scheduler, analyst or administrator moving quickly may treat a pop-up as another task to dismiss.

Security teams should therefore measure time spent, comprehension, repeat behavior and reporting, because completion counts on their own describe almost nothing about judgment.

What Did the Study Find About Annual Training Versus Just-in-Time Intervention?

Annual training performed poorly as a predictor of phishing resistance. The researchers found no significant relationship between recently completing mandated annual cybersecurity training and the likelihood of clicking a simulated phishing link. Completion therefore did not establish that employees could recognize or resist a later lure.

Embedded training also produced a small effect. After 10 campaigns, the aggregate failure rate was only 1.7 percentage points lower than the control condition. The finding challenges the assumption that immediate feedback automatically creates a durable correction.

The comparison does not argue for removing training. It argues for separating the role of training from the roles of technical controls, workflow design and repeated behavioral practice. Annual instruction can establish baseline knowledge. Embedded instruction can explain a mistake.

Neither format, used in isolation, demonstrated enough persistence to withstand eight months of changing lures and competing demands.

The study also showed how failures accumulated. In the first month, 9.7% of employees clicked a phishing link. By the eighth month, 56% had clicked at least one link.

That pattern does not demonstrate that training caused fatigue, because the experiment did not isolate fatigue from changing lure difficulty, repeated exposure, seasonal workload or other operational factors. It does show that early performance cannot be treated as proof of lasting resilience.

Which Phishing Lures Produced the Highest and Lowest Click Rates?

Lure design mattered more than a simple "trained versus untrained" label suggests. Only 1.82% of recipients clicked a message claiming that their Outlook password required an update. By contrast, 30.8% clicked a link presented as an update to UC San Diego Health's vacation policy.

The gap shows why phishing awareness training for employees must address context alongside visual warning signs. A password-reset message can trigger skepticism because employees have learned to distrust credential requests. A vacation-policy update can appear routine, relevant and low risk, especially when employees expect policy changes or need to check leave rules.

Cyberattackers do not need every message to work. They need one credible pretext to reach the right person at the right moment.

Security teams should test multiple motives and channels. Finance employees need invoice and payment scenarios. Human resources teams need benefits and payroll lures. Executives need vendor, travel and approval requests. A single password-reset simulation creates a narrow measurement that says little about exposure to business email compromise (BEC), malicious document sharing or policy impersonation.

What Does the Study Establish, and What Does It Not Establish?

The study establishes that annual training completion did not predict safer performance in this experiment. It establishes that embedded training shifted the aggregate failure rate by only 1.7 percentage points and that most users spent little time with the material. It also establishes that lure choice strongly influenced outcomes and that failures rose across the eight-month period.

The study does not establish that security awareness training never works. It did not test every curriculum, delivery method, reinforcement schedule, audience or technical environment. It focused on simulated email phishing at one large healthcare organization. The results should not be generalized automatically to every industry, or to vishing, smishing, deepfake video or in-person social engineering.

It also does not establish that employees were careless, that workload alone caused failures or that fatigue was the sole reason performance worsened. The experiment observed behavior but could not fully explain each participant's attention, workload, motivation or prior experience. Nor did it prove that a click represented real-world credential disclosure or financial loss.

Most importantly, the study does not measure long-term behavior persistence beyond the experiment. A participant might remember a lesson weeks later, apply it to a different channel or report a suspicious message without clicking. Those outcomes require separate measurement.

Security leaders should therefore track reporting rates, repeat failures, time to report and behavior across email, voice and SMS. Click rates and completion percentages describe only a fraction of that picture.

How Should Organizations Apply the Study's Recommendations?

The researchers recommended stronger technical countermeasures, particularly hardware multifactor authentication and password managers that fill credentials only on the correct domain. These controls reduce the consequences of a successful click.

A stolen password is less useful when MFA blocks access. A password manager that refuses to autofill on a fraudulent domain gives employees a technical signal at the point of action. Phishing-resistant MFA raises that bar further by binding authentication to the legitimate site.

Those controls should operate alongside training. Email filtering can remove known malicious messages before employees see them, although filters do not eliminate trusted-looking internal impersonation, newly registered domains or messages delivered through legitimate services.

Training helps employees recognize suspicious requests and report them, while filtering reduces the number of dangerous messages reaching the inbox.

A layered program should combine:

• Technical barriers: MFA, domain-bound password managers, email filtering and least-privilege access.
• Behavioral practice: Varied, role-specific simulations with short explanations and follow-up reinforcement.
• Operational measurement: Reporting speed, repeat behavior, lure-specific failure rates and persistent risk by role.

Training clearly retains a place in the program. Annual completion records and one-time point-of-failure pages are weak substitutes for layered protection and durable behavioral measurement.

Training builds judgment, technical controls limit impact, and repeated testing shows whether safer decisions persist. Judgment works best when it is specific to the context employees face, because a familiar request can defeat a generic lesson.

How Should Organizations Compare Phishing Awareness Training for Employees Case Study Results?

Phishing awareness training for employees case studies are useful only when leaders compare what each study measured, how it was designed, and which outcomes it tracked. The Italian hospital study examined customized phishing emails and behavioral responses in a defined clinical environment. The UC San Diego study evaluated repeated simulated campaigns across a large health care population.

The hospital findings offer practical insight into how personalization and local context influence behavior. The UC San Diego results provide stronger evidence about training effects over time, because researchers used repeated campaigns and a randomized controlled design.

Neither result works as a universal benchmark until the definitions, campaign difficulty, population, and surrounding security controls are aligned.

How Do the Italian Hospital and UC San Diego Studies Compare on Outcomes?

The comparison should separate susceptibility, reporting, and credential risk, because each outcome answers a different security question. A click rate measures whether an employee selected a link or opened a landing page. A report rate measures whether an employee notified the security team or used a reporting mechanism.

Credential submission measures a more consequential action, such as entering a username, password, one-time code, or other sensitive information. Treating these outcomes as interchangeable can make a modest click reduction appear to represent a major reduction in compromise risk.

The Italian hospital phishing simulation study is most useful for evaluating whether customized messages change employee behavior in a defined clinical environment. It describes a large hospital case involving more than 6,000 health care staff.

A message that references a hospital department, familiar workflow, or plausible internal process can test whether personalization increases realism and changes recognition. A higher click rate on such a message does not establish that employees became less safe across unrelated campaigns.

It could show that the campaign better matched the audience, that employees recognized the local theme, or that the organization's reporting process was easier to use.

The UC San Diego study provides a broader test of persistence. Researchers analyzed nearly 20,000 employees across 10 simulated phishing campaigns over eight months. The study found that embedded phishing training changed the aggregate failure rate by only 1.7 percentage points, while phishing performance also varied significantly by message type.

Ariana Mirian, a study co-author and senior security researcher at Censys, said the results "lend some suggestion that these trainings, in their current form, are not effective," according to UC San Diego. That caution is a reason to compare training design, message difficulty, and employee engagement instead of ranking studies by click rate.

A practical comparison grid should therefore look like this:

The grid helps leaders avoid a common error in phishing awareness training case studies: comparing a customized campaign's click rate with a large longitudinal study's average and calling the lower number proof of superior training. The numbers become meaningful only after the study designs and outcome definitions match.

Which Definitions Can Make Phishing Results Misleading?

The denominator can change the conclusion. A 10% click rate among all delivered emails is not equivalent to a 10% click rate among employees who opened the message, viewed the landing page, or reached the credential prompt.

Email filtering can remove high-risk messages before delivery, which lowers the apparent employee failure rate without changing employee judgment. Researchers should report delivered messages, unique recipients, opens where reliably measured, clicks, landing-page visits, submissions, reports, and exclusions as separate counts.

"Failure" also requires a precise rule. One study can define failure as clicking any link, while another counts only credential submission. A third can classify an employee as failing after opening an attachment or replying to the sender.

These definitions represent different levels of risk. Clicking a harmless training link signals susceptibility, while submitting credentials demonstrates a much closer path to account takeover. A report is a protective behavior even when the employee previously clicked, so one person can appear in both failure and success categories.

"Time to report" creates another source of distortion. A median report time calculated from the moment an email reaches an inbox differs from one calculated from the moment an employee opens it. Business hours, shift schedules, mobile access, leave, and alert-routing delays can move the result substantially.

A hospital worker on an overnight shift should not be compared with an office employee who receives a message during staffed security hours. The comparison is only fair if the study adjusts for exposure time.

Exposure must also be defined. It can mean receiving a message, seeing it, clicking it, submitting data, or encountering the same lure in a real incident. Strong case studies publish a flow from delivery to outcome and identify whether repeated campaigns used unique employees or the same participants.

Without that transparency, a falling click rate could reflect repeated practice, employee turnover, survivorship bias, or a shrinking pool of exposed workers. It may not reflect durable behavioral change at all.

How Much Causal Confidence Does Each Study Provide?

Causal confidence depends on whether the study can isolate training from everything else that changed. A lower click rate after training is not proof of effectiveness if the organization also tightened email filtering, adopted multifactor authentication (MFA), changed password-reset policies, launched a security campaign, or replaced employees who were initially more susceptible.

Those changes can reduce the consequences of phishing or alter the measured behavior without improving employees' ability to detect it.

Threat selection is equally important. A simple password-reset lure should not be compared with a highly plausible invoice request, executive impersonation, or message containing a familiar hospital workflow.

Campaign difficulty should be rated before launch using observable features such as authority pressure, personalization, domain similarity, request sensitivity, time pressure, attachment type, and the number of verification cues. Otherwise, an easier campaign can create an artificial improvement.

Improved reporting can also change the apparent result. Employees who learn to report suspicious emails might still click a simulated message before reporting it. A study that records only clicks misses that protective behavior, and one that records only reports can hide delayed recognition.

Leaders should examine a joint outcome: click without report, click followed by report, report without click, credential submission, and time to report. That sequence shows whether employees are interrupting a cyberattack earlier or responding only after exposure.

The UC San Diego design carries more causal weight because researchers used randomized assignment across campaigns, although even a strong design cannot answer questions it did not measure. The Italian hospital study can reveal whether localized scenarios fit operational reality, yet a single-site result cannot establish that the same intervention will work in every workforce.

Both studies become more valuable when treated as complementary evidence. Neither functions as a competing verdict on the other.

What Research Design Produces a Credible Training Result?

The strongest practical design begins with a preregistered protocol. It should state the primary outcome, analysis population, campaign schedule, exclusion rules, and minimum effect of interest before employees receive training.

Organizations should collect a baseline using comparable campaigns and randomize employees to training and control groups where ethically and operationally possible. When randomization is not practicable, matched groups should account for role, department, location, tenure, and prior performance.

Each campaign should receive a phishing difficulty score before deployment. Repeated measures should track the same employees over time while separately reporting new hires, departures, leave, and transfers.

Training exposure must be logged with the completion date, content type, time spent, and whether the employee received remedial instruction after a simulation. Post-training tracking should continue long enough to distinguish immediate recall from durable behavioral change.

The outcome set should include delivery, click, landing-page visit, credential submission, attachment interaction, report, report accuracy, and time to report. Where privacy and governance permit, researchers should also compare simulation results with real-phishing incidents, confirmed credential events, help-desk reports, and account-protection actions.

A program that lowers simulated clicks while producing no improvement in real incident reporting deserves a cautious interpretation.

Security leaders can evaluate any case study with this checklist:

• Does the study define click, report, submission, failure, exposure, and time to report?
• Does it disclose the denominator and provide raw counts alongside percentages?
• Was there a baseline and a randomized or well-matched control group?
• Were email-filter changes, MFA adoption, policy changes, and turnover measured?
• Did campaigns vary in difficulty, and was difficulty documented?
• Were the same employees tracked across repeated campaigns?
• Did the study report negative, null, or inconclusive findings?
• Did the analysis distinguish improved reporting from reduced exposure?
• Were real-phishing outcomes measured after training?
• Can another organization reproduce the intervention and analysis?

Organizations evaluating phishing simulations should demand this level of evidence from their own programs, applying the same standard they apply to published research. A credible result is rarely the lowest percentage in a case study.

A credible result is a transparent estimate that remains useful after campaign difficulty, measurement rules, workforce composition, and surrounding security controls change. That standard turns customized scenarios and longitudinal testing into decision-quality evidence.

How Do Phishing Simulations Work Across Email, SMS, Voice, and Collaboration Tools?

Phishing simulations show how employees make decisions under pressure across the channels cyberattackers use. A strong phishing simulation program creates a proportionate lure, delivers it through a realistic channel, and provides immediate feedback when an employee clicks, replies, scans, or complies.

Programs can begin with email and expand to SMS, voice, QR codes, collaboration tools, and AI generated media. At each stage the organization should measure reporting, verification, and recovery behavior without punishing mistakes.

1. Plan a Realistic, Proportionate Scenario

Start with the business action a cyberattacker wants to trigger. A generic template is a weak starting point for measuring real exposure. An email phishing simulation might request a Microsoft 365 sign-in, while a spear phishing simulation uses open-source intelligence (OSINT) to reference a department, project, supplier, or executive.

A business email compromise (BEC) exercise can ask a finance employee to change vendor bank details or approve a fraudulent wire transfer. The learning objective should be specific, such as verifying a payment request through a known channel or reporting a suspicious message before opening an attachment.

Choose lures that resemble real work without creating operational damage. Lookalike domains, realistic sender names, familiar invoice formats, and normal business language give employees useful signals to inspect.

Avoid payroll disruption, medical emergencies, job loss, personal financial harm, and messages that imitate a real crisis. Never collect live passwords, redirect users to an uncontrolled website, or expose an employee's result to peers.

Scenario design also depends on the delivery format carrying it. Computer-based training provides consistent explanations and scalable completion records, although passive modules do not show whether someone will act safely under pressure. Classroom training supports discussion, role-play, and department-specific questions, yet it is expensive to repeat and difficult to keep current.

Simulated phishing training tests behavior in context, although results become misleading when every exercise uses the same obvious email pattern. A mature program combines all three approaches and measures whether employees report, verify, and pause before complying.

2. Deliver the Simulation and Teach at the Point of Failure

Use realistic email scenarios that vary the trigger. One exercise might imitate a cloud-sharing notification. Another might simulate a supplier invoice, an executive request, or an urgent password reset.

AI-generated phishing emails should test whether employees inspect the request, sender context, destination domain, and unusual urgency, since grammar mistakes no longer work as a primary defense.

Extend delivery to mobile interfaces with smishing simulations and QR-code phishing, or quishing. A text message can direct an employee to review a benefits document, while a QR code on a printed notice or slide can lead to a simulated login page.

Mobile screens hide full sender addresses and make link inspection harder, so the exercise should measure whether users report the message through an approved mobile workflow. The FBI IC3 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints, the most reported crime type, which shows that filtering alone does not keep these messages from reaching people. Reporting behavior deserves as much measurement attention as recognition.

Vishing simulations add voice pressure. A caller can pose as IT support, a bank representative, or a senior executive and request a code, data disclosure, or payment. Deepfake video and AI voice cloning raise the verification standard further.

In 2024, a finance employee at Arup in Hong Kong transferred about $25.6 million after joining a video conference populated by deepfake participants, CNN reported. That scenario belongs in controlled training for finance and executive teams, although the exercise should teach an independent callback and dual approval without recreating the full emotional shock.

Provide point-of-failure microlearning immediately after the interaction. If an employee clicks, scans, replies, or stays on a simulated call, show the specific signal they missed and the safer action. Keep the message brief, then assign a short module or practice task.

The goal is to build skill, so the employee leaves with a usable correction. Employees who report a suspicious simulation should receive reinforcement, because reporting creates an actionable signal for the security team.

3. Expand Across Collaboration Tools and AI Impersonation

Once email, SMS, and voice workflows are established, add collaboration platforms such as Slack and Microsoft Teams. A simulated direct message can impersonate a project owner, request a document upload, or ask an employee to approve an unfamiliar application.

Channel-based exercises should test whether users verify identity outside the same platform, especially when a request involves credentials, sensitive files, or money.

AI impersonation requires scenario controls and explicit boundaries. In 2024, an impersonation of Ukraine's former foreign minister Dmytro Kuleba during a video call with U.S. Sen. Ben Cardin appeared consistent in voice and appearance until the caller behaved unusually and pressed politically charged questions, NBC News reported.

The practical lesson is direct. Employees must verify unusual requests through a trusted, separate channel even when the face, voice, relationship, and timing all appear authentic. A deepfake awareness training checklist gives executive and finance teams a repeatable verification sequence.

Review results by channel, role, and behavior. Individual rankings add pressure without adding insight. Track click or reply rates, QR scans, call compliance, reporting speed, verification attempts, and completion of follow-up training.

Use those signals to adjust lure difficulty and target additional practice. A multi-channel phishing simulation program should let employees practice realistic scenarios safely, so they learn to slow down when a familiar channel carries an unfamiliar request.

What Should Phishing Awareness Training for Employees Teach About Recognizing, Reporting, and Responding?

Effective phishing awareness training for employees teaches a repeatable sequence: pause, inspect the message and context, report it through the approved channel, and follow a defined response process if any interaction occurred.

Employees should verify unusual requests through a separate trusted channel and give security teams enough detail to contain the cyberthreat quickly. Fast reporting matters far more than blame, because early signals can protect coworkers before the same campaign reaches more inboxes.

1. Recognize the Red Flags Before Interacting

Treat unexpected requests as verification events. Cyberattackers count on employees handling requests on autopilot. Check whether the sender address and reply-to domain match the organization they claim to represent, including subtle substitutions such as extra words, altered characters or unusual top-level domains.

Hover over links without opening them and inspect the destination for shortened URLs, misspelled domains or a website that does not match the sender identity. A structured approach to spotting a phishing email gives employees a consistent order of checks.

Urgency is another major signal. Requests to bypass normal approval, pay an invoice immediately, disclose payroll data, approve an unusual MFA prompt or reset a password outside the normal process require independent confirmation.

The same applies to unexpected attachments, QR codes, credential requests and messages that push a conversation toward a personal account. A request can be malicious even when the grammar is polished. CISA phishing guidance published in October 2023 emphasizes stopping the attack cycle at the first point of contact, well before technical controls catch the activity.

Check the context alongside the message itself. Employees should also check context: whether the sender normally uses this channel, whether the timing matches a known project, invoice or meeting, and whether the request sounds unlike the supposed sender.

AI generated language can remove the spelling mistakes employees once relied on, and a deepfake video or cloned voice can add convincing authority. A message that creates pressure but provides no independently verifiable context should be stopped and verified.

2. Report Safely and Preserve the Signal

Employees should not reply, click an attachment, scan a QR code, call a number in the message or use its unsubscribe link. Report the message through the organization's one-click reporting button or approved email, SMS or voice reporting process, then leave the original intact if policy requires it.

The report should include the message, sender details, timestamp, attachment and any action already taken.

Security teams can use those details to triage the message, classify it as safe, spam or malicious, and search for related copies across the organization. They can block indicators, remove matching messages and escalate the incident to identity, endpoint or fraud responders.

Employees who report a suspicious message before clicking it have already delivered a valuable defensive signal. Employees who clicked should report it just as quickly.

A single, familiar reporting path lets employees report quickly under pressure. Organizations should place the reporting control where employees work, explain what happens after submission and reinforce that an honest report will not trigger punishment.

Phishing simulations and reporting workflows should rehearse email, QR codes, SMS, voice and video so employees build the same response habit across every channel.

3. Respond Immediately After a Click or Reply

After clicking a link, an employee should stop interacting with the page. Do not download anything, enter additional information or approve an MFA prompt. Close the browser tab, record the time and report the message.

If the page downloaded a file, opened an application or triggered unusual device behavior, disconnect the device from the network only when organizational policy directs it. Then contact the help desk or security team through a known channel.

An employee who entered a password should tell security staff exactly which account was used and change the password from a trusted device. Reset any other account that reused the same password, revoke active sessions where available and review MFA settings for unfamiliar devices, methods or recovery information.

An MFA prompt that appears after the employee closes the phishing page should never be approved, because it may be the cyberattacker trying to sign in.

An employee who opened an attachment should report the filename and any visible warning, macro prompt or application launch. Evidence should stay in place unless responders give other instructions.

Security responders should review the device, investigate execution or persistence, quarantine it when necessary and check whether files, credentials or tokens were accessed. A reply containing financial, personal or confidential information calls for immediate escalation to the relevant business owner, privacy team or financial fraud contact. Speed gives responders more opportunity to contain access and warn other targets.

4. Improve Controls After the Incident

After the immediate response, employees should cooperate with triage questions and leave independent investigation of the message to the security team. Security teams should determine whether credentials were exposed, whether MFA methods changed, whether the device requires isolation and whether similar messages reached other people.

They should also review mailboxes, sign-in activity, endpoint alerts and payment workflows connected to the incident. A documented phishing incident response playbook keeps those steps consistent under time pressure.

A clicked simulation or real phish identifies a training need, a control gap or a process that created unnecessary pressure. Use the event to deliver targeted coaching, clarify verification rules and test the same behavior again.

The goal is a faster report, a safer decision and a stronger human defense when cyberattackers repeat the tactic through another channel.

Why Is Ongoing, Role-Based Phishing Awareness Training More Effective Than Annual Training Alone?

Ongoing, role-based phishing awareness training works because it places the right decision in front of employees when their job, workload and current risk make that decision relevant. For CMS and its contractors, role-based training is required upon assignment, annually, and after major system or policy changes.

That schedule treats annual instruction as a baseline. A complete behavioral program needs more. Annual training establishes coverage, while context-specific practice turns knowledge into usable habits.

Why Does Annual Training Create Fewer Behavioral Opportunities?

Annual cybersecurity training delivers broad coverage, although it compresses dozens of cyberthreats into a single learning event that employees often complete far from the moment of risk. A finance employee can learn in January that urgent payment requests require verification, then face a convincing business email compromise (BEC) request six months later without having practiced the decision. The knowledge exists, but the response has not become automatic.

Point-of-failure training changes the timing. When an employee clicks a simulated phishing link or nearly sends sensitive information to an unfamiliar recipient, the organization can provide a short explanation immediately. When an employee reports a suspicious message, the organization can reinforce the behavior. That intervention connects the lesson to a real decision, clarifies the missed signal and gives the employee a safer action to repeat.

This approach does not replace onboarding or annual instruction. Onboarding establishes acceptable behavior before system access begins, annual training documents baseline coverage and periodic refreshers keep core practices visible. Event-triggered microlearning closes the gap between knowing a rule and applying it under pressure.

The CMS Awareness and Training guidance, describes a layered model that includes annual awareness training, simulated phishing campaigns, role-based instruction and updates after major policy or system changes. That structure treats training as an ongoing control well beyond a yearly administrative task.

How Do Workload and Context Affect Phishing Susceptibility?

Phishing succeeds when a request resembles normal work and arrives during a period when verification feels costly. A chief financial officer reviewing a payment queue, a nurse moving between patient rooms and a help desk analyst handling a password-reset backlog face different decisions even when the underlying cyberattack is social engineering.

Training that ignores those conditions teaches abstract warning signs when employees need to practice decisions under the interruptions they actually face.

Role-based phishing awareness training should mirror operational context. Executives and finance teams need practice with BEC, vendor bank-detail changes, payroll diversions and urgent requests that appear to come from senior leaders.

Healthcare staff need scenarios involving protected health information, patient portals, shared workstations, removable media and messages that pressure them to disclose records quickly. Help desk staff and IT administrators need exercises involving privileged access, MFA resets, administrator impersonation, remote-support tools and requests to bypass identity checks.

Remote and hybrid employees require a different emphasis, because work can occur on personal devices, home networks, shared screens and unmanaged peripherals. Training should show how to verify requests when colleagues are reachable through chat but not physically nearby, how to report suspicious activity from a mobile device and how to separate work data from personal accounts.

Technical restrictions should reinforce these behaviors where appropriate, including limits on external forwarding, privileged actions, unapproved file sharing and access from unsupported devices.

Which Groups Require Tailored Training and Support?

A single curriculum cannot reflect every employee's authority, information access or exposure. Build a common foundation, then adjust the scenarios, delivery method and follow-up for each population.

• Executives and finance teams: Rehearse payment verification, executive impersonation, vendor fraud, vishing and deepfake video requests. Require independent confirmation for high-value transfers, because a familiar voice or face proves nothing about identity.
• Healthcare staff: Use short, accessible lessons on protected health information, clinical urgency, shared devices and reporting. Avoid simulations that disrupt patient care and schedule practice around shifts.
• Help desk and IT administrators: Focus on identity proofing, privileged access, credential resets, MFA fatigue and suspicious support requests. Add technical controls when one mistake could grant broad access.
• Contractors, temporary workers, vendors and third-party partners: Provide training before access is granted, limit permissions to operational need and refresh instruction when contracts, systems or responsibilities change.
• Remote, hybrid and multilingual teams: Deliver mobile-friendly content in the employee's working language, with captions, transcripts, screen-reader compatibility, plain-language explanations and alternatives for visual, auditory, motor or cognitive disabilities.

Accessibility affects security outcomes, because employees who cannot use a training or reporting flow cannot act on it. Employees with different literacy levels, disabilities, language preferences, cultural expectations and home-network realities need equivalent ways to understand and report a cyberthreat. Use local examples without stereotyping, explain unfamiliar financial or workplace conventions and test whether the reporting path works from personal devices.

How Should Organizations Coach Repeat Failures?

Repeat failures should trigger coaching. Public punishment drives mistakes underground and suppresses the reporting a program depends on. Review whether the scenario matched the employee's role, whether workload or unclear procedures contributed and whether the employee knew how to verify the request.

A manager or security coach can walk through one recent event, assign a short refresher and pair the employee with a mentor for the next high-risk workflow.

Track reporting speed, verification behavior, repeat failure patterns and risk by role. Completion counts make a poor primary outcome. Security awareness training supports this continuous model by connecting simulations, microlearning and role-specific practice.

The strongest programs use each employee decision as a signal, turning targeted coaching into measurable behavioral change.

Which Metrics Show Whether Phishing Awareness Training for Employees Is Working?

For phishing awareness training for employees, completion and click rates measure exposure, while behavioral and business metrics show whether risk is changing. Completion identifies who opened a module. Behavior identifies who resisted a phishing email, reported it, or avoided submitting credentials.

A reliable framework combines behavior, response speed, and incident impact across comparable employee groups, over a period long enough to distinguish durable change from temporary caution.

Click rate measures the percentage of recipients who clicked a simulated phishing link. Reporting rate measures the percentage who alerted the security team. Reporting rate often has greater operational value than click rate, because an early alert can accelerate containment, although increased reporting can raise alert volume at first.

Which Behavior Metrics Show Whether Employees Make Safer Decisions?

Behavior metrics show whether phishing awareness training changes decisions under realistic conditions. Track click rate, credential submission rate, repeat-failure rate, training completion, and reporting rate for every campaign.

• Click rate: The percentage of delivered simulations that generate at least one link click. Use delivered messages as the denominator, exclude bounced or quarantined messages, and report results by department, role, language, channel, and campaign difficulty.
• Credential submission rate: The percentage of delivered simulations that produce a username, password, MFA code, or other requested data submission. This is a higher-severity signal than a click, because it shows willingness to disclose information.
• Reporting rate: The percentage of delivered simulations reported through the approved reporting mechanism. Separate reports made before interaction from reports made after a click or submission.
• Repeat-failure rate: The percentage of employees who fail more than once within a defined period, such as 90 or 180 days. Use this measure to assign targeted coaching without labeling employees as incapable.
• Training completion: The percentage of assigned learners who finish the required module within the measurement window. Treat completion as an input metric, since it says nothing about retention.

Compare each metric with a baseline and, where feasible, a matched control group. A large-scale longitudinal study of phishing training at a company, published at IEEE Symposium on Security and Privacy in 2022, sent 14,733 employees eight simulated phishing emails over 15 months.

It found that embedded training did not make employees more resilient, and that one training format was followed by higher click and dangerous-action counts than the control condition. Track the same employees long enough to test whether performance holds as campaign themes, timing, language, and channels change.

How Should Teams Measure Operational Response?

Operational metrics show whether employee action improves the security team's ability to contain real cyberthreats. Measure time to report, false-positive reporting, time to remediation, and the percentage of reports that produce a confirmed malicious verdict.

Time to report is the elapsed time between message delivery and an employee report. Use the median and 90th percentile, because the median alone can hide a long tail of very slow reports. Compare simulated and real-phishing results separately, and treat increased reporting as progress when alerts arrive earlier and analysts can classify them quickly.

False-positive reporting is the percentage of employee reports classified as safe or benign. A high rate can indicate over-reporting, unclear guidance, or a low reporting threshold. Do not suppress reporting to lower volume.

Measure whether automated classification, analyst triage, and feedback improve precision without discouraging employees from raising concerns.

Time to remediation measures the interval from the first valid report to removal, quarantine, password reset, account review, or another defined containment action. Compare it with time to report and incident impact.

If reports increase while remediation time and exposed recipients decline, the program is improving containment. Phish Triage connects employee reports to classification and remediation workflows.

Which Business Outcomes Prove That Training Reduces Risk?

Business outcomes connect employee behavior to incidents the organization must manage. Track the real-phishing incident rate, confirmed compromises, affected accounts, financial exposure, sensitive-data exposure, analyst hours per incident, and downtime when reliable records exist.

Real-phishing incident rate is the number of confirmed real-phishing events that cause a defined harmful action, divided by the number of active employees or monitored mailboxes during the same period. Define the harm threshold before measurement begins.

A click without credential entry, a credential submission followed by an immediate reset, and a confirmed account takeover belong in separate categories.

Measure whether faster reporting reduces incident impact by comparing the time from delivery to the first report, the number of recipients exposed before containment, and the actions completed after detection. A credible case study should show the baseline period, intervention period, population size, campaign mix, and follow-up period. Attributing every avoided incident to training alone overstates the evidence.

Normalize comparisons across departments, roles, languages, channels, and campaign difficulty. Finance teams facing invoice fraud should not be ranked against engineers receiving credential-reset tests without adjustment.

Report results by cohort, preserve the same denominator, and tag each simulation for difficulty, attack type, language, delivery channel, and whether the scenario used open-source intelligence (OSINT) personalization. Human risk scoring turns those tags into a comparable view across the workforce.

What Should a Phishing Training Data Dictionary Include?

A consistent data dictionary prevents incompatible measurements from becoming false comparisons. Define each metric before launch and retain the denominator in every report.

Use matched departments or control groups where feasible, keep cohorts stable across follow-up periods, and document exclusions such as bounced messages, quarantined tests, leave status, and duplicate reports.

That discipline turns phishing awareness training for employees from a completion exercise into an evidence-based program that demonstrates lasting behavior change, faster containment, and measurable reductions in incident impact.

How Can Organizations Run Ethical Phishing Awareness Training for Employees Without Damaging Trust?

Ethical phishing awareness training for employees works only when people trust the process, understand its purpose and know how their data will be used. Build the program with HR, legal, privacy, unions, managers, security operations and the help desk before launching a campaign.

Define safe boundaries, restrict access to results, prepare support capacity and disclose outcomes clearly so simulations strengthen reporting without creating fear.

1. Establish Governance, Consent and Accountability Before Testing

Start with a written simulation charter approved by security, HR, legal, privacy and, where applicable, employee representatives or unions. The charter should state the program purpose, participating groups, testing frequency, data collected, retention period, access permissions, accommodation process and escalation contacts.

Managers should review operational timing, while security operations and the help desk should confirm that simulated reports will not disrupt incident queues.

Employees should know that phishing simulations occur, even though they are not told the timing or content of each test. Tell employees that the organization conducts controlled phishing simulations, that participation supports organizational resilience and that individual results will not be used for performance ratings, promotion decisions, compensation or disciplinary action.

Where local employment law or collective bargaining agreements require consultation or consent, complete that process before testing.

Separate accountability for unsafe systems from punishment of individuals. If employees receive ambiguous instructions, lack a reporting button, face unrealistic workload pressure or cannot verify urgent requests, the organization owns those design failures.

Use simulation results to repair controls, clarify approval workflows and improve manager behavior. An employee who clicks a test should receive coaching and another opportunity to practice. Public blame teaches silence.

2. Design Safeguards Around Realistic but Proportionate Lures

Define acceptable lures before anyone writes the first message. Suitable scenarios mirror routine work without exploiting trauma, protected characteristics or personal hardship.

Examples include a vendor invoice requiring a second approval, a password-expiration notice that leads to a safe training page, or a familiar collaboration request that teaches employees to inspect the sender and verify the action.

Prohibit scenarios involving layoffs, medical diagnoses, bereavement, immigration status, payroll emergencies, threats to employment, personal debt, sexual content, political beliefs or fabricated emergencies involving a relative. Do not impersonate law enforcement, health care providers or family members.

Avoid collecting real credentials, opening external malware, creating financial commitments or sending simulated messages to personal accounts.

Apply privacy minimization from design through deletion. Collect only the signals needed to measure the exercise, such as delivery, interaction, reporting and follow-up training completion.

Replace names with role-based identifiers in routine dashboards, restrict detailed results to authorized security and program administrators, and log every access. Set a short retention limit, publish it in the charter and delete raw campaign data when the improvement objective is complete.

Build accessibility into every channel. Provide screen-reader-compatible pages, keyboard navigation, readable color contrast, captions and alternatives for voice or video simulations.

Offer reasonable accommodations without publicly identifying employees or lowering their standing. Do not run high-pressure tests during crises, overnight shifts without operational justification or periods when employees cannot reach support.

3. Prepare Support Capacity and Communicate After the Campaign

A simulation is incomplete until employees can ask questions and report concerns. Give the help desk a campaign briefing, response scripts and an escalation route to security operations.

The briefing should identify the test window, landing-page behavior, approved language and procedures for employees who believe they entered sensitive information. Security operations should monitor genuine reports separately from simulation metrics so a real incident is never dismissed as a test.

Organizations should choose phishing simulation programs that deliver role specific scenarios while keeping response and reporting behavior visible to the security team. The objective is rehearsal of the moment when an employee pauses, verifies a request, and reports a concern. Catching people out serves no defensive purpose.

Publish a post-campaign notice promptly. Explain what was tested, why the scenario was selected, how many employees reported it, what the organization changed and where employees can get help.

Do not publish departmental rankings, screenshots of mistakes or lists of people who interacted with the lure. Anti-shaming communication protects future reporting, because employees disclose uncertainty more readily when they expect coaching over ridicule.

Gamification works only when it rewards reporting, verification and improvement. Perfect scores and public competition push employees toward the wrong behavior, while private badges, team learning goals and recognition for useful reports reinforce what the organization needs.

Public leaderboards encourage employees to share test details, distort later results and turn security into a contest.

Protect the validity of future campaigns without creating secrecy. Rotate themes, channels and role-based scenarios, and explain that test content changes to measure decision-making across different conditions. Keep the rules stable even when the lures vary.

Ethical phishing awareness training succeeds when transparency governs the program, privacy limits the data and every result leads to a safer system. Punishing individuals signals a program that has lost its purpose. That standard turns each campaign into a measurable cycle of practice, reporting and behavioral improvement.

What Technical Controls Should Complement Phishing Awareness Training for Employees?

Phishing awareness training for employees builds judgment, while technical controls reduce the number of dangerous decisions employees must make. Training teaches people to challenge urgency, verify identities and report suspicious requests. Controls block, contain or authenticate activity automatically.

MFA and password managers limit the damage from stolen credentials, while email, domain, browser and attachment controls reduce the chance that employees encounter malicious content.

Employees still need to recognize smishing, vishing, quishing, deepfake video and other social engineering cyberattacks, because those techniques can bypass inbox defenses entirely. A strong program measures trained behavior alongside control performance and real incident outcomes, giving security leaders a clearer view of where human judgment still matters.

How Do MFA and Credential Protection Complement Training?

MFA addresses the failure mode in which an employee submits a password to a fraudulent login page. It does not validate an urgent payment request or stop a cyberattacker from impersonating an executive by phone.

Use phishing-resistant authentication for sensitive systems. NIST SP 800-63B-4, published in July 2025, classifies passwords, one-time passcodes and out-of-band authentication as vulnerable to phishing, while cryptographic authentication can bind access to the legitimate verifier.

Password managers reduce password reuse and help employees avoid typing credentials into unfamiliar sites. Training must show employees how to use the manager, reject unexpected prompts and report suspected compromise. Together, these controls address credential theft and keep employees involved in the defense.

Which Email, Domain and Browser Controls Reduce Phishing Exposure?

Email filtering reduces malicious messages reaching the inbox, while domain protection reduces spoofing of the organization's sender identity. Configure SPF, DKIM and DMARC, and use secure email filtering to inspect sender reputation, message behavior, URLs and attachments.

Attachment sandboxing, file-type restrictions, link scanning and time-of-click analysis address malware delivery and credential-harvesting links. Employees still need to recognize legitimate-looking requests that pass every technical check.

Browser protections extend that defense after a user clicks. DNS filtering, malicious-site blocking, URL reputation checks and browser isolation reduce exposure to fake login pages, drive-by downloads and compromised websites. Training supplies the judgment required when a new domain, shortened URL or QR code has not yet appeared in a reputation database.

Domain and browser controls do little against phone calls, text messages or convincing deepfake video. Phishing awareness training must therefore cover those channels, because cyberattackers can shift to channels where technical defenses have less visibility.

How Should Reporting Tools and Incident Response Work With Training?

A reporting button turns recognition into a security signal. Make reporting available in email and on mobile devices, then give employees immediate feedback so they learn whether a message was malicious, spam or safe. Federal phishing guidance emphasizes stopping cyberattacks early, which makes rapid reporting a measurable control in its own right.

A phishing response workflow should classify reports, remove matching messages from other inboxes, revoke exposed sessions and route high-risk events to incident responders. These actions convert an employee report into containment before a cyberattacker can reuse stolen credentials or persuade another recipient.

Incident response addresses what happens after an employee clicks, replies or shares information. Define separate playbooks for credential submission, malware execution, wire-transfer requests, suspected business email compromise (BEC), smishing and vishing.

Training should rehearse the first actions, including disconnecting a compromised device, contacting security through a trusted channel and preserving message or call details.

A fast, blame free response improves reporting quality and gives responders more time to contain the incident.

How Can Organizations Test Whether Training Reduces Real Incidents?

Simulation click rates show whether employees recognized a controlled lure. They do not prove that the organization is safer. Track time to report, reporting accuracy, repeat exposure, credential-submission attempts, successful verification of high-risk requests and the number of real phishing incidents that reach users.

Compare those measures by department, role, channel and time period, while accounting for changes in email volume and filtering rules. That separation distinguishes behavioral change from shifts caused by new technical controls or a different threat mix.

The clearest test connects training data to operational outcomes. Establish a baseline before training, run varied email, SMS, voice and QR simulations, and compare actual phishing incident rates with email filter detections and response times over successive quarters.

Review whether employees report genuine cyberthreats earlier and whether technical controls block more cyberattacks before delivery. A lower simulated click rate matters only when it accompanies faster reporting, fewer compromised accounts and fewer incidents requiring emergency response.

That combined view shows whether the organization is reducing human risk across the channels cyberattackers actually use.

How Should Organizations Report Phishing Awareness Training ROI and Compliance Evidence?

Phishing awareness training for employees case studies become valuable when leaders convert them into financial, operational and compliance evidence. The result is a measurable operating control that survives scrutiny from finance, audit and the board.

Leaders can compare program cost with expected loss avoided, analyst time recovered, help desk effort reduced and faster containment.

The randomized UC San Diego Health study of nearly 20,000 employees across eight months showed why a single measurement misleads, because the share of employees who had failed at least one simulation climbed steadily across the eight months. Trend reporting across repeated campaigns gives boards a clearer view than one annual click rate, although the study measured clicks and did not track reporting habits.

How Should Leaders Model Phishing Training ROI?

The strongest model starts with the full annual program cost. A subscription line item alone understates it. Include licensing, implementation, content administration, employee time, simulation design, analyst review, and help desk support, then divide the total by enrolled employees to produce an internal cost per employee for modeling purposes.

Finance and security leaders can use that baseline to compare security awareness training ROI with other risk-reduction investments.

Expected loss avoided should remain a probability model. Presenting it as a promise of breach prevention misleads the board. Estimate the annual probability of a credential theft or payment-fraud event before training, multiply it by the modeled financial impact, then compare that figure with the post-training estimate.

Include direct fraud, investigation, legal response, notification, downtime and recovery costs when the organization has defensible internal data.

A conservative model uses low, central and high loss scenarios. One attractive figure presented as certainty invites the wrong decision. The model should also document its assumptions, data sources, time horizon and confidence level. That discipline prevents a favorable case study from becoming an unsupported budget claim.

Case studies become more useful when they connect behavioral change to operational savings. If employees report suspicious messages earlier, calculate analyst minutes saved per report and help desk hours avoided through fewer credential resets.

If the security team contains reported messages faster, record the median time from employee report to classification, remediation and closure. These measures show how phishing training affects workload even when no prevented breach can be attributed with certainty.

They also connect employee behavior to security operations, where leaders can track the effect of faster reporting without overstating causality.

What Should a Board Report Include?

A board report should show exposure, movement and business effect on the same page. Start with employees tested, simulation interaction rate, reporting rate, median time to report and changes by department or role.

Connect those results to high-consequence workflows such as finance payment approvals, privileged access, customer support and executive impersonation.

Leaders should report the sample size, campaign design, comparison period and known limitations beside every result. A click-rate change from 12% to 8% is not automatically meaningful when campaigns use different audiences, difficulty levels or delivery channels. Report confidence intervals when the sample and campaign design support statistical comparison.

Negative results belong in the board narrative. A simulation that produces no improvement can identify weak content, poor timing, limited manager reinforcement or an attack pattern employees have not practiced. Pair the finding with a corrective action, accountable owner and review date.

Operational costs also belong in the report, including employee time, campaign administration, false-positive investigations and disruption caused by poorly timed exercises. Honest limitations increase confidence in the conclusions, because they show where the evidence is strong, where it is directional and what the program will change.

How Can Phishing Training Support Compliance Evidence?

Compliance evidence should demonstrate a controlled process. A claim that training eliminates human risk will not survive an audit. For HIPAA, retain mapped training content, assignment records, completion status, simulation results and remediation evidence showing how workforce security awareness is maintained.

For GDPR, connect training records to documented risk treatment, data-protection responsibilities and role-specific handling of personal data.

PCI DSS evidence should show that relevant personnel received required security education, that phishing and payment-fraud scenarios were tested where appropriate and that exceptions were tracked to closure. NIS2 evidence should connect management accountability, risk-based training and incident-reporting behavior to the broader cybersecurity risk-management process.

ISO 27001 evidence should map modules, attendance, simulation logs, corrective actions and improvement trends to applicable controls in the information security management system. SOC 2 reporting benefits from the same evidence chain, including policy-linked training, employee acknowledgments, access-relevant role assignments, simulation outcomes and documented follow-up.

A security awareness training program mapped to selected control objectives can organize these records. The evidence must still reflect the actual scope, policies and operating procedures of the company. A platform record does not replace an organization's responsibility to define requirements, assign ownership and review exceptions.

A structured awareness training audit tests that chain before an external assessor does, and the compliance requirements for awareness training vary by framework and sector.

The practical test is traceability. An auditor or board member should be able to move from a stated risk to assigned training, from training to observed behavior, from behavior to remediation and from remediation to the next measured result. That chain turns phishing case studies into evidence of disciplined risk treatment.

How Does Phishing Awareness Training Fit Into Broader Human-Risk Management?

Phishing awareness training for employees fits into human-risk management by turning isolated clicks, reports and response decisions into a broader view of how people encounter and handle social engineering.

A 2025 study of 8,102 employees found that susceptibility and reporting behavior varied by department, age and job level, according to research published in Computer Standards & Interfaces. A fair program interprets behavior in context. One simulation outcome is never a permanent verdict.

Why Are Behavioral Signals More Useful Than Click Rates Alone?

Behavioral signals show whether an employee recognizes risk and takes the right action under pressure. A simulation click captures one decision, while reporting speed, credential submission, repeated failures, escalation quality and response after coaching provide a fuller view of phishing resilience.

An employee who clicks once but reports the message within minutes presents a different risk pattern from someone who clicks repeatedly, enters credentials and leaves the security team unaware.

Successful decisions matter just as much. Employees who report suspicious emails quickly, verify unusual payment requests through a second channel or warn colleagues about a scam create defensive signals that a simple click-rate dashboard misses.

A modern phishing simulation program should measure both exposure and recovery, because rapid reporting gives security teams time to remove malicious messages before more employees interact with them.

Training data should distinguish unfamiliarity from disregard. A first failure after a long period of safe behavior calls for targeted coaching and fresh measurement. Repeated failures across different scenarios may indicate a persistent skill gap that requires closer support, which public blame does not provide.

The objective is behavioral change, so every signal should lead to a constructive intervention.

How Do Role and Context Change Human Risk?

Context determines how much weight a signal deserves. A finance employee who approves invoices, a help-desk analyst who resets credentials and an executive who receives urgent requests face different attack paths. The same simulated email carries different consequences depending on access, authority and daily workload.

Exposure also changes the risk picture. Public interviews, conference videos, organizational charts and social media posts provide open-source intelligence (OSINT) that cyberattackers use to personalize spear phishing.

A busy employee managing high transaction volumes can face more realistic payment fraud attempts than a colleague with no financial approval authority. Risk assessment should account for that exposure, because assuming every employee encounters identical cyberthreats distorts the result.

Workload and timing matter as well. A request arriving during a deadline, staffing shortage or major organizational change can increase pressure to act quickly. Security leaders should review whether a scenario reflects a plausible work context and whether internal processes make verification practical.

Human-risk management becomes fairer when it examines the conditions surrounding a decision alongside the decision itself.

The threat model must extend beyond email. AI-generated phishing produces polished messages at scale, while deepfake impersonation, vishing and smishing move manipulation into video calls, phone conversations and text messages.

OSINT-informed spear phishing can combine these channels into a believable sequence. Employees need practice recognizing unusual requests across every channel, pausing, verifying identity and reporting the attempt before pressure turns into compliance.

How Should Organizations Turn Risk Findings Into Improvement?

Continuous improvement requires a closed feedback loop. Collect signals from simulations, reporting speed, role, exposure, workload, repeated outcomes and real incident response.

Review the pattern with enough context to separate a one-time mistake from a recurring vulnerability. Then assign targeted training that matches the behavior, such as invoice-fraud practice for finance staff, vishing verification drills for help-desk teams or deepfake impersonation exercises for executives and their assistants.

Remeasurement completes the process. After training, repeat a comparable scenario and assess whether the employee identifies the cyberthreat, reports it and follows the required verification procedure faster. A fair risk picture should show progress as clearly as exposure.

It should also protect employee privacy, limit access to individual records and use scores to direct support, since ranking and punishment degrade both the data and the behavior. Human risk management depends on employees who report honestly.

This approach makes phishing awareness training part of an operating discipline, far removed from an annual compliance event.

What Should a Credible Phishing Awareness Training Program Do?

A credible phishing awareness training program turns case-study lessons into a phased operating plan. Establish a baseline, identify the cyber threats employees actually face, rehearse realistic behaviors, and measure change over time.

Start with stakeholder agreement and privacy safeguards, then connect employee reporting and training feedback to technical controls. Treat every result as a decision signal, because a scorecard used to blame employees teaches them to stay quiet.

1. Build the First 30 Days Around a Measured Baseline

The first 30 days should establish what employees face, how they respond, and how the organization will judge improvement. Review recent incidents, near misses, reported messages, business email compromise (BEC) attempts, vishing calls, smishing messages, and exposed executive or finance workflows.

Use open-source intelligence (OSINT) to assess whether public information makes spear phishing more convincing, while documenting sources and avoiding unnecessary personal data collection.

Define measurement terms before launching a test. A baseline should distinguish delivery rate, open rate, click rate, credential-submission rate, report rate, time to report, and time to triage. Record the audience, channel, scenario difficulty, sample size, exclusions, and test window.

Without those definitions, a lower click rate can reflect an easier scenario well before it reflects safer behavior. A structured approach to running phishing simulations keeps those variables consistent from the first campaign.

Bring security, IT, HR, legal, privacy, communications, and representatives from high-risk teams into a stakeholder review. Agree on simulation boundaries, escalation procedures, accessibility requirements, and the difference between a learning event and a disciplinary event.

Confirm that training content works with assistive technology, is available in the necessary languages, and reflects the responsibilities of finance, executives, customer support, engineering, and other roles.

Align the program with the incident response process before employees receive a simulated phish. NIST SP 800-61 Revision 3, published in April 2025, places incident response within broader cyber-risk management, reinforcing the need to connect reporting, investigation, containment, and recovery.

Publish a plain-language privacy notice explaining what the program collects, why it collects it, who can access it, how long it is retained, and how individual results are protected.

2. Use the Following 60 Days for a Controlled Pilot

The following 60 days should test the program with a limited, representative group before organization-wide deployment. Select a small, representative pilot group across several roles and channels, deliver accessible role-based content, and run simulations that reflect actual responsibilities.

A payroll employee should rehearse invoice and payment diversion, an executive assistant should practice urgent calendar and document requests, and an engineer should recognize repository or credential lures.

Keep the first simulations realistic but non-destructive. Do not request actual passwords, interrupt critical operations, or use sensitive personal events as bait.

Give employees a one-click reporting path in email and on mobile, then measure whether reports reach the right queue and whether analysts can classify and route them quickly. The Phish Triage workflow connects that signal to a response process that classifies suspicious messages and supports remediation.

Feedback should arrive immediately after an employee misses a simulation. Explain which cues mattered, show the safe verification step, and provide another practice opportunity without shame. Compare behavior by role and channel, and keep public rankings out of the program.

A high click rate can indicate an overly difficult scenario, a confusing interface, or a legitimate workflow that the simulation disrupted, so review those conditions before changing the curriculum.

Use the pilot to test technical alignment. Confirm that the one-click phishing report button, mail controls, identity protections, ticketing system, security operations workflow, and escalation contacts work together. A training program that teaches reporting but leaves reports unanswered teaches employees that reporting has no operational value.

3. Optimize Continuously and Publish Accountable Results

Ongoing optimization should combine simulation data, real incidents, analyst feedback, employee questions, and changes in cyberattacker behavior. Review the program quarterly against actual incidents.

Identify which lures reached employees, which controls blocked or missed them, how quickly employees reported them, and whether follow-up training addressed the failure point. Update scenarios and technical controls together, because recycled generic modules stop producing new information.

Publish results with transparent methods, limitations, and actions. Report the population tested, channels used, scenario difficulty, response window, participation exclusions, and definitions for every metric.

State whether results came from a pilot or the full workforce, and avoid claiming that simulation performance predicts every real-world decision. Pair each result with a specific action, such as revising finance verification procedures, improving mobile reporting, or adding vishing practice for executives. Established methods for measuring a phishing simulation program keep those reports comparable quarter to quarter.

Protect trust by reporting aggregate trends to leaders and restricting individual data to authorized personnel with a legitimate operational need. Retain only the data required to deliver training, investigate risk, and demonstrate improvement.

The strongest program is rarely the one with the lowest test click rate on paper. It is the one that helps employees recognize pressure and report uncertainty quickly, and that gives security teams the evidence to improve both human behavior and technical controls.

Phishing Awareness Training for Employees FAQs

What Is the Strongest Evidence That Phishing Awareness Training for Employees Reduces Real-World Phishing Incidents?

The strongest evidence for phishing awareness training for employees combines a randomized or matched comparison, repeated measurement, and real phishing outcomes, none of which simulated click rates alone can supply.

The UC San Diego Health study followed more than 19,500 employees for eight months and compared annual training with embedded interventions. It provides unusually strong evidence about behavior over time while also showing the limits of training alone.

A peer-reviewed Italian hospital phishing simulation study demonstrated how lure personalization changes susceptibility, although it did not establish fewer real cyberattacks. The most credible case study therefore tracks reporting, credential submission, containment speed, and real incidents alongside clicks.

How Often Should Phishing Awareness Training for Employees Include Simulated Phishing Tests?

Phishing awareness training for employees should include simulated phishing tests several times a year, with spacing that allows learning, measurement, and operational recovery. Use varied but proportionate scenarios across email, mobile, collaboration, and voice channels, and reserve higher difficulty for employees who have received relevant coaching.

Pair every failure with immediate, private feedback. Public ranking damages the reporting culture the program depends on. CISA recommends that organizations teach employees how to recognize and report phishing, which makes reporting practice a core outcome and not a click-rate contest.

Avoid high-volume campaigns that create fatigue or overload the help desk. Review frequency against reporting quality, time to triage, repeat failures, and employee workload.

What Sample Size Is Needed for a Reliable Phishing Awareness Training Case Study?

No single sample size makes a phishing awareness training case study reliable. The required number comes from a power analysis using the baseline failure rate, expected effect, comparison design, clustering, and attrition.

A large population strengthens precision, although a smaller organization can produce useful evidence with repeated measures, a matched control group, and transparent confidence intervals. The UC San Diego Health study of more than 19,500 employees illustrates the scale possible for a strong organizational evaluation, and it sets no universal threshold.

Report the denominator for every outcome, separate departments or roles when risk differs, and avoid treating a handful of dramatic incidents as proof. Statistical planning should precede campaign launch.

How Long Should Organizations Track Employees After Phishing Awareness Training to Measure Lasting Behavior Change?

Organizations should track employees for at least six months after phishing awareness training, with 12 months preferred when the goal is durable behavior change. A short post-test captures recall. It says nothing about whether employees report real cyberthreats during changing workloads and attack conditions.

The eight-month UC San Diego Health evaluation shows why repeated observations matter. It compared annual and point-of-failure training across an extended period, going past a single follow-up measurement.

Measure simulated behavior, reporting speed, repeat failures, credential submissions, real-phishing incidents, and containment time. Preserve a baseline and matched comparison where feasible. Longitudinal evidence turns a temporary score change into a defensible risk decision.

How Can Organizations Measure Whether Phishing Awareness Training Improves Reporting Without Overwhelming the Security Team?

Organizations can measure reporting improvement by pairing reporting rate with report quality, false-positive rate, time to triage, and analyst workload. Use a one-click reporting path, automatically deduplicate identical messages, and route high-confidence reports for rapid containment while sampling lower-risk reports for quality review.

Track reports per 1,000 delivered messages, the percentage that identify genuine cyberthreats, median time to report, and the time required to resolve each queue.

Federal guidance advises employees to report suspected phishing and tells organizations to make the reporting process clear. A reporting dashboard can connect behavior to operational outcomes without penalizing employees, which creates the measurement discipline needed for sustained improvement.

Measure and Improve Employee Behavior Across Phishing Threats

Phishing attacks evolve across email, SMS, voice, collaboration tools, and deepfake impersonation, while click rates alone cannot show lasting behavior change. Adaptive Security connects realistic testing, reporting behavior, and risk signals so security teams can target coaching and measure progress. Take a self-guided tour of Security Awareness Training.