Phishing Awareness Training for Corporate Email: How to Train Staff and Measure Impact

Why is staff training not enough on its own?

Many phishing programmes rest on the assumption that a trained employee will spot every fake email. The UK’s National Cyber Security Centre (NCSC) takes a different view: over-reliance on users is ineffective, some attacks will always get through, and organisations should plan to limit the damage. ^[3]

The NCSC proposes four complementary layers:

• Stop emails reaching users: domain authentication with SPF, DKIM and DMARC, inbound filtering, and a smaller digital footprint for staff.
• Help users identify and report: training, verifying sensitive requests through a second channel, and easy reporting.
• Limit the effect of a click: patched devices, blocking malicious websites, and multi-factor authentication.
• Respond quickly: incident detection and a rehearsed response plan. ^[3]

The NCSC describes a financial firm that received 1,800 malicious emails: filtering stopped 1,750, 14 of the 50 that arrived were clicked, and only one malware installation succeeded, which was detected and cleaned up within hours. ^[3] The lesson is that training is an important layer, but not the only line of defence.

What do Saudi controls require for email awareness?

In Saudi Arabia, the Essential Cybersecurity Controls ECC-2:2024, issued by the National Cybersecurity Authority (NCA), require an approved awareness programme delivered through multiple channels. It must cover secure handling of email services, “especially phishing emails” (control 1-10-3-1), and its implementation must be reviewed periodically (1-10-5). ^[1]

The same controls require, under email protection (2-4-3), message analysis and filtering, multi-factor authentication for remote and webmail access, and validation of the entity’s email domains with SPF, DKIM and DMARC. ^[1] They apply to government entities and their affiliates, and to private-sector organisations that own, operate or host Critical National Infrastructure. ^[1]

Elsewhere in the GCC, refer to the standards issued by your own country’s national cybersecurity authority, and do not assume the Saudi controls apply to you.

What should staff actually learn?

The aim is not to turn employees into email analysts but to teach them when to stop, check and report. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends focusing on: ^[5]

• Strange or unexpected requests, especially those using alarming language or demanding immediate action.
• Judging the request, not just the sender, because a known sender’s account may be compromised.
• Verifying through known channels before acting on anything unusual.
• Knowing how, and to whom, to report.

The NCSC adds two practical points: extra support for higher-risk roles such as those handling payments or sensitive data, and changing processes so they are harder to imitate, for example confirming transfer requests by phone. ^[3] CISA also notes that annual training alone is not enough and reminders should be repeated at regular intervals. ^[5]

How do you design a fair and useful phishing simulation?

NIST SP 800-50 Rev. 1, published in September 2024, describes a simulation as a deceptive email sent to see whether users spot it or click the link or open the attachment. It recommends first measuring current click rates by group or work role to see where targeted training is needed, and stresses that exercises should not be punitive and no employee should be called out. ^[2]

To make results comparable, NIST developed the Phish Scale, which rates a simulated email’s difficulty on two dimensions: the cues that give it away, and how well the scenario’s premise fits the target audience’s work. Each exercise is then ranked as low, medium or high difficulty. ^[4]

Brief design rules:

1. Agree the approach with HR and legal before the first campaign; punishing people for clicking a simulated phish may look like entrapment. ^[3]
2. Build scenarios from the real working environment, such as internal system notifications and supplier requests, and vary the techniques.
3. Rate each email’s difficulty before sending it, so an easy campaign is not compared with a hard one.
4. Show a short learning page straight after a click, not a reprimand.

Which metrics actually measure impact?

Click rate is the best-known metric, but NIST warns that a low rate may come from emails that are too easy, lack relevant context or resemble a previous exercise, creating a false sense of security. ^[4] That is why the NCSC recommends measuring reports alongside clicks. ^[3]

NIST SP 800-50 Rev. 1 says measurement should go beyond compliance. Its examples include tracking responses to simulated attacks, incident-reporting metrics, knowledge tests before, immediately after and three months after training, and the percentage of people who changed a workplace behaviour, such as reporting a suspected phishing email. ^[2]

Hypothetical example: reading two campaigns

Hypothetical example: in the first quarter a government entity sends a low-difficulty simulated email; 6% of staff click it and 10% report it. In the third quarter it sends a high-difficulty email imitating an HR system notification; 9% click and 35% report.

A superficial reading says performance has slipped because clicks went up. The correct reading is that the second email was far harder, yet reporting more than tripled, so staff have become an effective early warning. The next step is targeted training for the HR and finance departments if clicks were concentrated there.

Why does punishment kill the reporting culture?

The NCSC says blaming users for clicking does not work, because clicking has personal and situational causes, and fear of punishment stops staff reporting their mistakes, so the organisation loses its early warning. ^[3] The employee who clicked and then realised is exactly the person you need to hear from quickly.

To build that culture, make the report button or mailbox quick and easy, tell reporters what happened to their report, reassure staff that reporting will not get them into trouble, and secure HR’s and senior management’s commitment to that. ^[3]

A practical plan for launching or rebuilding the programme

1. Baseline: send one simulation of known difficulty to all groups before any new training, and record clicks and reports for each department and work role. ^[2]
2. Reporting channel: provide one clear way to report, such as a button in the email client or a dedicated mailbox, and commit to replying to every report. ^[3]
3. Role-based training: short content for everyone, and deeper content for higher-risk groups such as finance, procurement and people with wide access rights. ^{[2, 3]}
4. Regular, graded campaigns: vary the scenarios and rate each email’s difficulty before sending, so comparisons stay fair. ^[4]
5. Management report: present clicks, reports and difficulty together, and propose targeted training and changes to processes and technical controls, not lists of names of people who clicked.
6. Periodic review: review the programme’s implementation and results and update the content with new techniques; for entities subject to the Saudi controls, this review is an explicit requirement. ^[1]

Conclusion

Successful phishing awareness training is not measured by falling clicks alone but by staff who quickly report realistic, difficult emails. Start with a baseline for each group, rate the difficulty of every simulation, track reporting and behaviour alongside clicks, and treat training as one part of a layered defence, not a substitute for it.