Phishing still works. Train for the click that will happen

Phishing simulations are useful, but treating click rates as the main metric misses the point. In any organisation of reasonable size, someone will click. The real questions are how fast it is reported and how little that click can do.

Reward reporting

A one-click “report phishing” button and a fast, friendly response turn employees into sensors. People who are scolded for clicking stop reporting.

Make stolen passwords worthless

Phishing-resistant authentication, such as security keys or passkeys, breaks the most common outcome of a successful lure: a reused password and a one-time code typed into a fake login page.

Assume the click. Engineer the consequences.