4

Phishing Simulation

SL-06

Two simulations a year against the whole workforce, each followed by targeted training for the people who clicked. This is the only training measure that tests behaviour under realistic conditions rather than recall in a quiet room.

DischargesS.8(4)R.6
Campaigns
3
Click rate
9%

Current campaign

Credentials submitted
62
Reported
20%

The metric to optimise

Targets
4,820

Campaigns

Funnel — Q3 simulation — cloned departmental login

Each stage is a decision point. The gap between opened and clicked is where training shows up.

Delivered4,640 · 100%
Opened2,104 · 45%
Clicked the link418 · 9%
Submitted credentials62 · 1%
Reported it940 · 20%
62 people entered credentials into a page that was not ours. In a real campaign each of those is a plausible route to a personal data breach, which is why the follow-up training is mandatory rather than recommended.
Click and report rate across campaigns

Click rate down, report rate up. Both directions are the intended result.

Click rate by department

Departments at the top of this list get the follow-up module assigned automatically.

Human Resources16 of 170 · 9.4%
Procurement & Vendor Management83 of 1147 · 7.2%
Education & Scholarships63 of 1117 · 5.6%
IT & Digital Infrastructure22 of 429 · 5.1%
Citizen Registry & Family ID47 of 934 · 5%
Welfare Scheme Delivery24 of 1194 · 2%
Grievance & Public Response21 of 1091 · 1.9%
Health & Nutrition Services5 of 632 · 0.8%
Follow-up trainingM5

418 learners who clicked have been enrolled in Consent & Notice Handling with a 14-day due date. Enrolment is automatic — a manual step here is a step that gets skipped.