Most successful attacks still start with a person: an employee who opens a convincing attachment, approves an unexpected payment or types a password into a fake login page. Organisations know this, yet many awareness programmes amount to an annual slide deck and a quiz, and nobody can say whether behaviour has changed.
Awareness is not the goal. Behaviour is. A programme that cannot show how staff respond to a realistic attack today, compared with six months ago, is a compliance exercise rather than a control.
Why do most awareness programmes fail?
Traditional awareness training tends to fail for the same few reasons.
- It is an event, not a habit. A once-a-year session competes with everything else people learn that year and is largely forgotten by the time a real phishing email arrives.
- It tests knowledge, not reactions. Staff can pass a multiple-choice quiz about phishing and still click a well-crafted lure when they are busy, tired or under pressure from someone who appears senior.
- It treats everyone the same. A finance clerk who processes supplier payments, a developer with production access and an executive assistant who manages a director's mailbox face different threats. Generic content addresses none of them well.
- It produces no useful data. Completion rates show that people sat through the training. They say nothing about whether the organisation is harder to attack.
The result is a programme that consumes time and budget while the human attack surface stays the same.
What does a measurable programme look like?
A measurable programme starts by finding out how staff actually behave, then works to change that behaviour, then measures again. The core tool is the controlled simulation.
Phishing simulations send realistic but harmless emails to staff and record what happens: who opens the message, who clicks the link, who enters credentials, and, just as important, who reports it. Good simulations mirror the lures criminals use against South African organisations, such as fake invoices, courier notifications, tax and banking messages, and requests that appear to come from internal leaders.
Social engineering simulations extend the test beyond email. They can include pharming pages that imitate internal portals, text messages, voice calls that try to extract information or reset passwords, and physical tests such as tailgating into secure areas. Each one shows where a process depends on people saying no and whether they do.
Behavioural nudges turn a failed simulation into a learning moment. Someone who clicks a simulated phishing link sees a short, specific explanation of the warning signs they missed, at the moment the lesson is most relevant. This is far more effective than a reminder months later.
How should you measure susceptibility?
The value of simulations lies in the data they produce. Useful measures include:
| Measure | What it tells you |
|---|---|
| Click rate | How many people act on a lure |
| Credential submission rate | How many would have handed over access |
| Report rate | How many people alert the security team |
| Time to first report | How quickly the organisation could respond to a real attack |
| Repeat susceptibility | Which individuals or teams need more support |
Track these by department, role and lure type. The pattern matters more than any single result. A falling click rate shows training is working. A rising report rate shows staff have become part of the defence rather than just a target. A team that keeps falling for invoice fraud lures points to a process gap in payments, not only a training gap.
Be careful with how results are used. Simulations should identify where support is needed, not shame individuals. People who fear punishment stop reporting mistakes, and an unreported click on a real attack is far more costly than a reported one.
How do you build the programme over time?
A practical cycle looks like this:
- Baseline. Run an initial assessment across the organisation to establish current susceptibility and identify high-risk roles.
- Target. Build short, role-specific training for the groups and lure types that performed worst.
- Simulate regularly. Run simulations throughout the year, varying difficulty and technique so staff cannot learn the pattern of the test.
- Fix the process, not just the person. Where results show a weak process, such as payment changes approved by email alone, change the process.
- Report to leadership. Give executives and the board trend data they can use to judge risk, alongside other security controls.
Done well, this turns awareness from an annual obligation into a measured control with evidence behind it.
What MITS Institute does about it
MITS Institute designs and runs security awareness programmes built on social engineering assessment. We establish a baseline with phishing and social engineering simulations, identify the roles and processes most at risk, deliver targeted behavioural training, and report trends that leadership can act on. This work sits within our information security consulting practice and connects to the wider controls in our cyber security solutions, so awareness findings feed directly into policy, process and technical improvements.