PHISHING EXERCISES / LEARNING DESIGN
Practise the response.
Do not just count clicks.
A useful exercise improves the system people rely on when a suspicious message arrives.
A simulated phishing message can tell you who clicked. A useful exercise should also reveal whether a worried employee can get help, whether the report reaches someone who can act, and whether the organisation limits harm.
Google’s Matt Linton used a fire-drill analogy to challenge the focus on individual failure. His argument asks organisations to reconsider what they rehearse and what their results actually demonstrate.
THE EXECUTIVE BRIEF
Measure the response you need in a real incident.
- Treat click rate as one observation, with the scenario and delivery conditions attached.
- Practise reporting and escalation, including after someone has already clicked.
- Assign improvements to the systems and processes that can prevent or contain harm.
THE BACKSTORY / MAY 2024
Why Google compared phishing tests with fire drills.
In his 22 May 2024 essay, Linton contrasted surprise evacuation tests with engineered fire protection and rehearsed evacuation. He argued that phishing exercises likewise overemphasise individual mistakes while neglecting protective systems.
He described the risks of bypassing email defences for simulations, burdening response teams, and weakening employees’ trust. An allowlisted test measures a deliberately altered environment; forgotten exceptions can become another exposure.
His proposed alternative was an announced phishing drill: explain the suspicious message and let staff practise the reporting route. Suggested measures included participation, time to the first report and escalation, and reporting over subsequent hours. He also advocated architectural defences, including phishing-resistant credentials and approval controls.
This is Linton’s case for changing the exercise model, rather than proof that every simulation has no value. A leader should ask which decision the exercise informs and whether its design supports that decision.
THE EVIDENCE / KNOW ITS LIMITS
One study challenges a familiar training model.
The ETH Zurich study cited by Google followed 14,773 employees at one company over 15 months, from July 2019 to October 2020. Its embedded training did not improve resistance in that setting and could have adverse effects. Employees’ reports, however, helped detect campaigns quickly and remained useful over time.
Those findings concern the intervention, employer, and period studied. They do not establish that all education is ineffective or that the same result must occur in every organisation. They do support evaluating the learning method rather than equating attendance, completion, or a falling click rate with reduced loss.
THE EXERCISE RECORD
Give the board evidence beyond a pass rate.
A RESULT WITH LIMITED CONTEXT
“How many clicked?”
Record the audience, scenario difficulty, delivery conditions, and what counted as interaction. Avoid presenting a percentage without those conditions.
REPORT
Could the concern reach us?
Capture the first report and whether the reporting route worked on the devices people use.
TRIAGE
Did someone recognise its significance?
Record acknowledgement, escalation, and whether related reports were brought together.
CONTAIN
Could we limit the consequence?
Rehearse the relevant account, message, or payment decision within an authorised exercise scope.
IMPROVE
What changes before the next drill?
Name an owner and a completion date, then recheck the weakness that matters.
CyberSolace exercise record. These are review prompts, not measured response times or a claim that one sequence fits every incident.
Agree the purpose before selecting the message. A reporting rehearsal, a payment-verification exercise, and a test of email filtering answer different questions. If a simulation needs delivery exceptions, document exactly which controls were bypassed and remove those exceptions afterwards.
Compare like with like when reviewing repeat results. A harder lure, a different population, or a change in reporting tools can alter the number without indicating that people became less careful. Describe the uncertainty instead of turning it into a league table.
RUN IT WITHOUT ERODING TRUST
Make it safe to report a mistake.
Tell staff how the exercise programme works and what learning it is intended to produce. Avoid humiliating individuals or using sensitive personal circumstances to maximise emotional pressure. Agree the scope with the people responsible for staff welfare and incident response.
Include an explicit post-click route: someone who entered information should know how to ask for help immediately. A programme that celebrates catching people can make the most valuable report harder to obtain.
Plan the response-team workload too. Determine which reports are exercise traffic, how they will be grouped, and how genuine incidents will remain visible. The exercise should test a workable service rather than create an unmanaged flood of messages.
THE WIDER DEFENCE
Training must sit alongside protective engineering.
The NCSC’s layered guidance combines preventing delivery, helping people report, limiting the effects of missed messages, and responding to incidents. Its analysis of blame and fear also explains why shame after a click can delay reporting.
For a business, that means reviewing email protections, device maintenance, sign-in methods, and payment-authorisation processes as part of the same risk decision. Give each control a responsible owner. A training supplier cannot correct every weakness in account design or financial approvals.
Where available, passkeys offer phishing-resistant sign-in. They address credential phishing; they do not prevent every fraudulent instruction or remove the need to protect account recovery. Check the actual account journey, including fallback methods, before describing the protection to management.
THE NEXT USEFUL STEP
Rehearse one consequential decision.
Choose a suspicious-message scenario with the business owner. Agree what a good report and a good response look like, then record what needs to change.
SOURCES & EDITORIAL REVIEW
The Google argument and research findings are attributed above. The exercise record and management recommendations are CyberSolace commentary. Original publication history retained; research and presentation reviewed 20 October 2026.