The short answer
Yes, run them. Done well, they let staff meet the risks safely, alongside clear procedures for verifying and reporting suspicious messages. They help only if behaviour changes: realistic scenarios, one-click reporting with quick feedback, coaching rather than blame, and metrics that track reporting, not only clicks.
Why the click rate misleads
A falling click rate may be progress, or easier templates, staff who recognise the test sender, people ignoring unknown senders (customers included) or a WhatsApp group warning whenever a test lands. Meanwhile the habit that protects you most, reporting quickly, may not have improved. One early report of a real phish lets security remove it from every inbox before others click: worth far more than a low click rate.
Design scenarios that teach something
Supplier invoices
Invoice and bank account change requests (a classic fraud), for finance and payables.
Shared documents
Document and e-signature notices that mimic tools staff use daily.
Deliveries
Courier notices, for operations and reception.
Executive requests
Airtime, gift cards or urgent transfers, aimed at assistants and managers.
MFA and password prompts
Teach staff never to approve a prompt they did not start.
QR, SMS and WhatsApp
Attackers move outside email, and many staff work mostly on a phone.
Vary difficulty from many warning signs to few. Each scenario needs a one-sentence teaching point on its landing page.
Ground rules that keep staff on side
Simulations are workplace monitoring; handled badly, they breed resentment. Our rules:
Announce the programme
Say simulations will happen, why and how results are used (not each test).
No public shaming
And no league tables of individuals.
No cruel lures
No fake bonuses, layoffs, health scares or tragedies; they damage trust and teach little.
Coach privately
A short, friendly explanation, not a note to the manager.
Thank reporters
Automatic thanks; occasional recognition for teams that report well.
Protect the results
Employee personal data: limit who sees individual results and how long you keep them.
Include leadership and IT: exempting them sends the wrong message and leaves high-value targets untested.
Rather talk it through? If your current simulations produce reports but no real change, we can redesign them around reporting and coaching. Talk to a Promatics specialist
Metrics that show real change
NIST guidance asks learning programmes to encourage behaviour change and use metrics to evaluate and improve over time (NIST SP 800-50 Rev. 1). Track these by department and scenario type, not by individual.
| Metric | What it tells you |
|---|---|
| Report rate | Share who reported the message |
| Time to first report | How fast the first alarm was raised |
| Click rate | Share who clicked a link or opened an attachment |
| Credential entry rate | Share who went on to enter a password |
| Repeat clicks | Who needs more support, handled privately |
| Real phishing reports | Whether the habit carries over to real attacks |
Strongest signal: report rate up, time to first report down, more real suspicious messages reported to IT.
Make reporting easy and worthwhile
Reporting must take seconds: a report button, an automatic acknowledgement and someone who reviews reports. Staff who report a real attack and hear nothing stop reporting. Technical controls matter as much: filtering, SPF, DKIM, DMARC and MFA reduce what reaches people and limit damage. Our email security service covers that side.
What usually goes wrong
- Gotcha culture: results go to managers, people are embarrassed, staff stop trusting IT.
- One template for everyone: finance never sees an invoice lure; the warehouse gets an executive memo.
- Annual tests only: they measure little and teach less.
- No closing of the loop: reports land in a mailbox nobody reads.
Programme checklist
- Programme announced to staff, with purpose and data handling explained
- Report button deployed and reported messages reviewed
- Scenarios mapped to roles and real threats
- Difficulty varied over the year
- Landing pages explain the teaching point
- Private, coaching-based follow-up for clicks
- Leadership and IT included
- Report rate and time to first report tracked
- Access to individual results restricted; retention period set
When to bring in help
Email platforms' built-in tools run basic simulations. Bring in a professional for scenarios fitted to your suppliers and systems, results needing careful employee-relations handling, or links to incident handling so reported messages are investigated and removed fast. AI writes a convincing lure in seconds; it cannot judge which lures are fair, run the programme monthly, respond to a real report or tell leadership honestly what changed.
Our cybersecurity awareness training combines short lessons, realistic simulations and reporting that shows whether behaviour improves. For the wider programme, see building a security awareness training programme that changes behaviour.
Limitations
General guidance, not legal advice. Monitoring expectations differ by sector and workplace, and the Nigeria Data Protection Act 2023 covers employees' personal data too: settle the lawful basis and retention of results with your data protection officer, and involve HR (and your legal adviser where appropriate) before launching.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, National Institute of Standards and Technology
- Nigeria's computer emergency response team (ngCERT), Nigerian Communications Commission, ngCERT
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.