Why quarterly phishing tests fail, and what monthly-per-person fixes
Sending one campaign to everybody every three months optimises for administrative convenience. Here is what changes when you pace per person instead.
Read article →Blog
Research and practice in human risk
What 4.6 million simulations actually show, and what the security teams running them have learned about cadence, channels, deliverability and reporting.
All articles
Latest writing
AllResearchPractitionerProduct
Deliverability is the hard part nobody advertises
A simulation sitting in quarantine produces a flattering number and teaches nobody. What actually has to be configured, and why.
Read article →Beyond email: why smishing, vishing and quishing belong in every programme
Attackers moved channels years ago. An email-only programme measures your office workers and calls it an organisation.
Read article →Stop reporting completion: measuring human risk instead of attendance
Training completion measures whether people showed up. Here is a factor model that measures whether they are getting harder to attack.
Read article →Running simulations without wrecking trust
The fastest way to kill a report rate is to make people afraid of being wrong. Framing, manager comms, and the lures never to send.
Read article →Want the benchmark data for your industry?
Book a demo and we will run a live campaign against a test group, then compare your result to comparable organisations.