Case Study: A Technology Awareness Program People Did Not Ignore

Most awareness training fails for a simple reason: it is designed to satisfy an auditor, not to change behaviour. When a client asked us to fix a program that existed on paper but not in practice, we started by throwing away the annual all-staff slideshow.

The client

A professional-services organisation whose people handle sensitive client information daily, with a compliance obligation to run security awareness training — and a workforce that had learned to click through it.

The challenge

Simulated phishing campaigns showed click rates that did not improve year over year. The training content was generic, the cadence was annual, and reporting a suspicious email felt like admitting a mistake rather than doing the right thing.

What we did

• Replaced the annual marathon with short, frequent modules tailored to each role's actual risks
• Ran phishing simulations as coaching moments — whoever clicked got a two-minute explanation, not a naming-and-shaming report
• Made reporting effortless and always acknowledged, so people learned that raising a hand is welcome
• Recruited volunteer champions inside each team to keep the topic alive between sessions
• Established a measured baseline first, so improvement claims rested on data rather than impressions

The outcome

Simulated-phishing click rates fell steadily across consecutive campaigns and, more tellingly, reporting rates rose — people started catching what the filters missed. The program now runs with modest internal effort, and training stopped being the compliance line item everyone resents.