Home / Continuous / People
People
Phishing simulation that measures whether your controls and your training are working, without turning your staff into the finding.
What it covers
- Phishing simulation campaigns on an agreed cadence
- Measurement of what your technical controls caught before anyone saw it
- Aggregate reporting of click, submit and report rates over time
- Whether your reporting path works, and how quickly staff use it
- Trend measurement across campaigns, so training can be evaluated
Commitments to your staff
These are conditions of the module, not preferences. A phishing programme that becomes a disciplinary instrument stops measuring anything useful, because people stop reporting.
- Results are reported in aggregate only
- No individual is ever named to management
- Results are never used for disciplinary purposes
- Lures exclude pay, redundancy, medical matters and personal hardship
- The approver must be HR or an executive, not IT
How the work is carried out
A consultant directs this module and does the work that needs judgement, with automation carrying the continuous load between their passes. Your intervals are set during onboarding and recorded in the service agreement, because a schedule that suits one application would be wrong for a large, sprawling estate. What is fixed is the shape: a scheduled layer that runs the same checks on fixed intervals so change is visible, and an exploratory layer that a consultant directs based on what turns up. Reporting is monthly.
What the tooling handles
- Handles campaign delivery and response measurement at scale
- Aggregates response data across the staff population
- Assembles the campaign figures for the consultant to interpret
What our consultants do
- Design each campaign, and write and review every lure against the agreed boundaries
- Review results and decide what they actually indicate
- Write the report, and keep individual-level data out of it
Every finding in this module is reproduced or confirmed by a consultant before it reaches you.
What you receive
- Aggregate campaign results, with no individual identified
- A monthly written report, including trend against previous campaigns
- An assessment of whether your technical controls and reporting path worked
- Recommendations aimed at controls and training, not at individuals
- A review call once a quarter
What is out of scope
- Individual-level reporting to management, under any circumstances
- Lures touching pay, redundancy, medical matters or personal hardship
- Physical intrusion and tailgating, which we do not offer
- Calling your staff or your help desk, unless separately scoped and approved
Prerequisites
Nothing runs until these are in place. We pause rather than proceed against an unconfirmed register.
- Written approval from HR or an executive. IT approval alone is not sufficient
- An agreed staff population for the campaigns
- Agreed lure boundaries, recorded in writing before the first campaign
- An agreed plan for what staff are told, and when