Running simulations without wrecking trust

Simulated phishing is a test you run on colleagues without warning them of the specific occasion. That is defensible, and it stops being defensible quickly if the results are used as material for humiliation.

Lures never to send

• Redundancy, restructuring or termination notices.
• Bonus, pay-rise or payroll-error messages.
• Medical results, benefits changes or anything touching a family member.
• Charitable appeals tied to a live disaster.

These produce excellent click rates and lasting damage. A programme that needs distress to generate a result has a content problem, not a measurement opportunity.

Framing that holds up

1. Announce the programme, its channels and its purpose before it starts.
2. Report at team level publicly and at individual level privately.
3. Make the reporting path trivially easy and thank every report, including the false positives.
4. Never send a leaderboard of failures. Send a leaderboard of reporters if you send one at all.

We stopped naming people in the monthly update and our report rate doubled in six weeks. Nothing else changed.

Awareness lead, 4,200-person financial services firm

What managers need

Managers ask two questions: is my team a problem, and what do I do about it. Give them a department grade, the size of their repeat cohort, and the specific modules assigned. Do not give them a list of names to raise in a one-to-one unless your culture has genuinely earned it.

The goal is a workforce that tells you when something looks wrong. Every design decision that makes people feel watched rather than supported works directly against that.