Phishing defence beyond awareness training

If your phishing strategy depends on every employee being right every time, it has already failed. A convincing message will get through, and someone will click. The useful question is not how to achieve a zero click rate - it is how much damage a click can do.

Technical controls come first

Every message stopped before delivery is a message no one has to judge:

• Email authentication - SPF, DKIM and DMARC at enforcement, so nobody can send as your domain. A DMARC policy left at monitoring provides no protection at all.
• Inbound filtering with attachment sandboxing and link rewriting.
• External sender banners - simple and measurably effective, particularly against display-name impersonation.
• Blocking risky attachment types outright rather than scanning them.
• Phishing-resistant MFA, which converts a successful credential phish into a non-event.
• Lookalike domain monitoring, since DMARC does not stop a similar domain the attacker owns legitimately.

Then design for the click

Assume someone will click, and reduce what follows: least privilege so a compromised account reaches little, conditional access so a stolen session from an unmanaged device fails, and - critically - out-of-band verification for payment and bank detail changes.

That last control is the one that matters most commercially. Business email compromise causes larger aggregate losses than ransomware, and it is defeated far more reliably by a phone call to a known number than by any filter or training module.

Simulations, done without damaging trust

Simulations are useful for measuring, not for punishing. Programmes go wrong when they become adversarial:

• Never punish clicking. The moment people fear consequences they stop reporting, and reporting is the control you actually need.
• Avoid cruel pretexts - fake bonuses, redundancy notices, health scares. They generate outrage rather than learning, and the damage to security's credibility outlasts the exercise.
• Measure reporting rate, not just click rate. A team that clicks 5% and reports 60% is in far better shape than one that clicks 2% and reports nothing.
• Give immediate, non-judgemental feedback at the moment of clicking.
• Track repeat clickers for support, not discipline - they usually need a workflow change, not a lecture.

The reporting button is the real control

A one-click report button in the mail client, feeding a queue somebody actually monitors, is worth more than several training modules. It turns thousands of employees into sensors and gives you early warning of a campaign in progress.

Two things make or break it: speed of response - if reports vanish silently, reporting stops - and thanking people who report false alarms, because the alternative is under-reporting when it counts.

What to measure

• Reporting rate, and time from first report to containment.
• Click rate, as a trend rather than a target to game.
• Proportion of malicious mail stopped before delivery.
• Whether payment-change verification was followed - test this deliberately.

Key takeaways

• Stop messages before delivery; every filtered mail is one nobody must judge.
• Design for the click - least privilege, conditional access, payment verification.
• Measure reporting rate, and never punish clicking.
• The report button, monitored and responded to, is the highest-value control.