Every organisation claims its staff are trained. Very few can say what proportion of them would click a convincing message on a Tuesday afternoon. Awareness that has never been measured is a belief, not a control.
Campaigns runs authorised phishing simulations and measures how each recipient reacts to them.
Authorisation first
A simulation is an exercise conducted against your own organisation, or one you have written authorisation to test. That is not a disclaimer at the bottom of the page — it is the condition the capability exists under. Used any other way, it is an attack, and the product is not built for that.
What gets measured
- Who received it and when it landed.
- What each recipient did — opened, clicked, submitted, reported it.
- How quickly it was reported, which is usually the more useful number.
A click rate says how persuasive the message was. A reporting rate says whether the organisation would find out in time. Mature security programmes optimise the second.
Why results belong in a case file
Awareness results age badly as slide decks and well as evidence. Kept in the case file with the scope, the dates and the authorisation behind them, a campaign becomes something you can put in front of an auditor, compare against last quarter, and use to justify where training money goes.
People, handled carefully
Results identify employees, which makes them personal data with an obvious potential for misuse. Use them to improve defences, not to discipline individuals; keep them for as long as the security purpose requires and no longer. The same retention discipline applies as to the rest of a case — see provenance and retention.
Frequently asked questions
Can I run this against another company? Only with documented authorisation from that organisation, within an engagement.
Does it train people as well as test them? It measures behaviour. What you do with the result — targeted training, process change — is the programme around it.
What is a good result? A falling click rate matters less than a rising, faster reporting rate.
Read next: Leaks or what Engramite is.