Phishing is a process problem, not a training problem

After an incident, the finding is almost always the same sentence: an employee clicked a link. The remedy is almost always the same too — more training, delivered more often, with a test at the end.

Training is worth doing. It is also nowhere near sufficient, and treating it as the primary control is why the same companies have the same incident again two years later.

The arithmetic of a well-trained workforce

Suppose training is genuinely effective and gets your click rate down to a few per cent. That is a real achievement. Now send a convincing message to four hundred people, which costs an attacker essentially nothing, and ask how many clicks you need for the campaign to succeed.

One. The attacker needs one. You need everyone, every time, including the week they are covering for a colleague and working through two hundred emails before a deadline.

An attacker needs one person to be fooled once. You need everybody, every time. That is not a contest attentiveness wins.

This is not a failure of your staff. It is a structural property of the problem, and it means the goal has to change: not "nobody is ever fooled", but "one person being fooled is not enough to cause a loss".

Controls that hold when someone clicks

These are ordered roughly by how much they return for the effort.

• Phishing-resistant multi-factor authentication — passkeys or hardware security keys. Codes from an app are far better than nothing, but they can be relayed through a convincing fake login page in real time, and fatigue-prompting defeats push approvals. A key bound to the real domain simply does not authenticate against the fake one.
• A verification path for payment changes that does not use the channel the request arrived on. Any request to change bank details gets confirmed on a number already on file — never a number in the email. This one control stops most invoice fraud, and it costs nothing but discipline.
• Reporting that is one click and is never punished. If reporting is a hassle, or if people suspect they will look foolish, your detection time is however long it takes the attacker to act. The organisations that catch these early are the ones where reporting a false alarm is treated as a good outcome.
• Limit what a compromised account can reach. Most staff do not need access to most systems. Least privilege turns a full breach into a contained one, and it is the control with the widest blast-radius reduction per pound spent.
• Make external mail visibly external, and align your own domain with SPF, DKIM and DMARC so impersonating you is harder in the first place.

Why blame makes it worse

A person who has just clicked something is in the best possible position to limit the damage, and the window in which they can is measured in minutes. Everything about your culture determines whether they use it.

If the expected consequence is embarrassment or a note on their record, the rational move is to hope it was nothing. That hesitation is worth more to an attacker than any technical weakness you have, and it is produced entirely by how the last incident was handled.

What to do about simulated phishing

Simulations are useful for measuring whether reporting works. They are much less useful as a stick, and the versions that use genuinely cruel pretexts — a fake bonus, a fake redundancy notice — buy a one-off statistic at the cost of the reporting culture you actually need.

Measure the report rate, not just the click rate. A team that clicks at four per cent and reports at sixty is in far better shape than one that clicks at two and reports at five, because the second team will not tell you when the real one lands.

The test worth applying

Take your most plausible scenario — a finance mailbox compromised on a Thursday afternoon, say. Walk through it honestly. What can that account reach? What would it take to move money? Who would notice, and how long would that take?

If every answer depends on somebody spotting something, you are relying on attentiveness as a control. Train people anyway. But build the process so that the training not working is survivable, because sooner or later it will not work.