Phishing simulations are easy; measuring resilience is hard
Many security-awareness strategies include internally-initiated phishing simulation campaigns to measure phishing reports and unwise clicks, seemingly to provide security awareness training.
Here at Link Group, we believe a mature organisation should ask a more useful question: how effectively do we detect, report and mitigate actual phishing attacks? That distinction matters. The National Cyber Security Centre advises organisations not to over-emphasise users’ ability to spot every phishing email because some attacks will inevitably get through.
Genuine resilience depends on layered controls, easy reporting and rapid responses. Google has made a similar argument, warning that conventional phishing simulations can create artificial conditions by bypassing layered cyber-security controls and then measuring individual failure rather than organisational resilience.
Don’t catch people out
Link’s position is straightforward: we don’t run internal phishing simulation campaigns. That isn’t because phishing is unimportant; it’s because trust is.
Housing providers depend on colleagues who work in complex, busy and emotionally-demanding roles, often supporting customers through difficult circumstances. If cyber security is experienced as a game of ‘gotcha’, we risk weakening the same respect-based culture that protects the organisation.
Human-centred cyber-security research is helpful here: the ‘human as solution’ mindset argues that well-intentioned employees should be treated as contributors to resilience, not as weak points to be controlled. Research on shame in cyber security also shows why shame-based strategies can be counterproductive, damaging to wellbeing, eroding trust and deterring reporting.
Counterproductive strategies
The evidence base is increasingly uncomfortable for phishing simulations. A large randomised controlled study involving more than 19,500 employees at a healthcare organisation found no significant relationship between recent annual awareness training and simulated phishing performance, and only a small practical benefit from embedded phishing training.
Another study of simulated phishing campaigns found that people who clicked reported significantly higher stress and lower phishing self-efficacy than those who reported the email, raising a serious question: if an exercise reduces confidence and increases stress, has it strengthened resilience or weakened it?
No-blame culture
The NCSC is equally direct: blaming users for clicking doesn’t work, fear of reprisals discourages reporting and metrics should include successes such as reporting, not just failures such as clicking.
Auditors often like phishing simulations because they appear to offer tidy numbers (sent, opened, clicked and failed). Google notes that some compliance regimes have required phishing simulations, even where those tests force organisations to bypass their own technical controls, thereby creating a distorted view of the real risk.
But easy-to-audit isn’t the same as meaningful. The click-rate of a synthetic exercise tells us little about whether an organisation can identify a live campaign, remove malicious emails, block harmful links, protect credentials, recover quickly and learn from the event.
Real operational outcomes
That is why we measure real operational outcomes. Our monthly cyber-security assurance reporting tracks phishing reports, phishing emails remediated, remediation cases and phishing email clicks, alongside mail inspection data such as suspicious email delivery to quarantine, junk and inboxes. We map actual attacker activity to actual organisational response, and we treat reporting as an early-warning system and a sign that colleagues trust our Digital Services team enough to ask for help.
Link has recognised that attackers are most commonly trying to establish malicious Microsoft 365 sessions. By using tailored mail-inspection rules that identify and filter emails using suspicious indicators, we direct any suspicious emails to quarantine for review by senior technical colleagues. This explicitly shifts the assessment effort towards Digital Services and reduces the burden on the wider business. That’s a stronger assurance story than “we fooled seven per cent of staff during our last phishing simulation”.
Link’s security awareness strategy supports that culture. Our heuristic security-awareness training comprises an annual interactive webinar that emphasises vigilance, shared responsibility and a growth mindset, and reminds colleagues that Digital Services are ready to support them. The training uses real phishing email reports as examples, practical reporting guidance and the ‘slow down and frown’ technique, which aligns with peer-reviewed work by Patricia Nevin, Karen Renaud and George Finney on encouraging people to pause when processing emails.
Don’t be scared
Our message is deliberately human: the threat is real, we’re not trying to scare people, Digital Services is here to help, and if something happens colleagues should get in touch as soon as possible.
Our interactive training is supported by an internally-narrated video presentation which covers best practices (equally applicable to work and home), discussing safe browsing, multi-factor authentication, encrypted email, trusted networks, endpoint protection, strong password creation and management, AI-powered threats and social-engineering attacks such as QRishing, tailgating, USB baiting and shoulder surfing.
To complete training, all delegates are required to score above 80 per cent on a quiz. Link also uses additional security awareness e-learning to further reinforce security-awareness principles.
Operational resilience
The resilience loop is therefore operational, not theatrical: phishing reach is limited by technical controls; colleagues report suspicious emails that manage to make it to inboxes; Digital Services analyses and remediates; malicious content is blocked; campaigns are remotely deleted where necessary; and the resulting evidence informs mail-filtering rules, training and governance. Above all, a cycle that is valuable to measure.
For housing providers, a better approach might not be to replace phishing simulations with softer simulations, friendlier traps or more palatable drills. Even well-intentioned drills can be perceived as attempts to catch people out if colleagues believe security is testing them rather than supporting them.
The better path is to stop deception-based employee testing altogether and build assurance from real-world evidence: how much malicious mail was blocked, how much reached inboxes, how quickly colleagues reported it, how quickly Digital Services removed it, tracing malicious link clicks, whether technical controls mitigated or avoided compromise and the improvements that followed.
The housing sector doesn’t need cyber-security theatre. It needs trusted colleagues, strong technical controls, honest reporting and operational evidence that attacks are being detected and contained.
At Link, our strategy is to continuously measure and improve the resilience of the technical controls, not to exploit the fallibility of people.
Gareth Renaud is a cyber-security specialist for digital services at Link Group.
References
Google Security Blog (2024), On Fire Drills and Phishing Tests. Available at security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html
Renaud, K. & Dupuis, M. (2019), Moving from a Human-as-Problem to a Human-as-Solution Cybersecurity Mindset. Available at rke.abertay.ac.uk/ws/portalfiles/portal/15927807/Renaud_Moving_from_a_Human_Accepted_2019.pdf
Ho, G. et al. (2025), Phishing Training Research Study, University of Chicago. Available at people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf
