A badly run phishing simulation program can do more damage than good. It can erode trust, cause anxiety, and make employees hate the security team. Here is how to do it right.
Top 5 Best Practices
1. Vary the Difficulty: Start easy to build confidence. Don't hit them with a spear-phish on Day 1.
2. Frequency Matters: Once a year is an audit. Monthly is training.
3. Focus on Education: No naming and shaming. The 'Teachable Moment' should be helpful, not punitive.
4. Don't be Cruel: Avoid sensitive triggers like 'Layoff Notices' or 'Bonus Announcements'. It destroys morale.
5. Celebrate Reporters: The 'Report Rate' is more important than the 'Click Rate'. Gamify the defense.
