A multi-location company cuts its phishing click rate and lifts its report rate in 12 months
A US services company with 14 locations and about 450 staff, a leader in its segment.
- Scale
- About 450 staff across 14 sites, 1 Microsoft 365 tenant, 4 role tracks
- Engagement
- 12 months, with monthly simulations and quarterly reviews
The challenge
Managers at each site handled invoices, gift-card requests and password resets, and the company had run one annual training video. A first simulation showed that staff clicked often and almost never reported, so the security team learned about attacks from the people who had fallen for them, if at all.
A US services company with 14 locations and about 450 staff, a leader in its segment, had run one annual security video. The client is not named on this page, and this is an illustrative case. The question the leadership asked was simple: are people actually getting better at spotting attacks?
A baseline simulation answered it. Staff clicked often and almost no one reported. Site managers handled invoices, delivery notices and gift-card requests, which attackers know well, and the security team found out about attacks only from the people who had been caught by them.
We built four role tracks: site managers, accounts payable, the help desk and new hires. Lessons were short and monthly. We added a one-click report button in Microsoft 365 and a promise that every report receives a same-day reply, because a report that disappears teaches people to stop reporting. A no-blame policy and in-person coaching for repeat clickers kept the tone constructive.
Simulations rotated themes each month, from invoices and delivery notices to QR codes and MFA prompts, and results were shared by site, not by person. A callback rule for any change to bank details or gift-card purchases gave managers a clear step to take when a message felt wrong, whatever it said.
In the modeled twelve months, the click rate fell from about 28 percent to about 6 percent and the report rate rose from about 9 percent to about 58 percent. The second number is the one that matters: real phishing began to be reported before anyone clicked. These are illustrative figures, not a guarantee. See our Security Awareness Training service for how the program is run.
What our team delivered
- A baseline phishing simulation to measure click rate and report rate before any training
- Role tracks for site managers, accounts payable, the help desk and new hires, with short monthly lessons
- A one-click report button in Microsoft 365 and a promise that every report gets a reply the same day
- Monthly simulations that rotate themes: invoices, delivery notices, gift-card requests, QR codes and MFA prompts
- A no-blame policy, repeat-clicker coaching in person and quarterly results shared by site
- A callback rule for any change to bank details or gift-card purchases
Result
In this modeled program the click rate fell from about 28 percent to about 6 percent over twelve months while the report rate rose from about 9 percent to about 58 percent, so real phishing was increasingly reported before anyone clicked. The figures are illustrative, not a guarantee; results vary by company and by how consistently simulations and coaching continue.
Five million events, three escalations
What a managed SOC does to a day of log volume for a 250‑seat organisation. Collection produces millions of events; correlation rules turn them into a thousand or so alerts; triage merges and dismisses most of those into dozens of incidents; only a few need a human on the customer side. Bar length is the logarithm of the count, so each step is orders of magnitude. Illustrative figures.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
DMARC: from watching to rejecting
Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.