According to the Verizon 2024 Data Breach Investigations Report, the median time between opening a phishing email and clicking the link is 21 seconds. From there it takes another 28 seconds to enter one’s data. Falling for phishing takes less than a minute. The same report, drawing on security awareness exercise data, found that 11% of the people who clicked also reported the email.
With those timings, what defines a security awareness program is what happens after the click. In many programs that is a row in a report that says “clicked” and a course assigned for a few weeks later, when the person no longer remembers which email it was or why they opened it.
This article walks through how an automated response to risky behavior works: what can happen in the minutes that follow, who each part of it talks to, and what gets recorded.
What is an automated response to risky behavior?
It is the set of actions a security awareness platform carries out on its own when it records an unsafe behavior, aimed at the person who did it and at the teams that need to know, at the moment of the event. It does not wait for the next campaign or for someone to open a report.
In SMARTFENSE that response has three parts, and each one talks to someone different. The Teachable Moment and the Nudge talk to the person. The Playbook talks to systems and to the people who need to act.
| Response | Who it talks to | What triggers it | Channel | Available since |
|---|---|---|---|---|
| Teachable Moment | The person who took the action in a simulation | The click or a QR code scan, the data entry or another action chosen for the campaign | Browser, and optionally email | Version 1.19 |
| Nudge | The person involved in the event | Events from any component, reports included, and Microsoft Defender alerts | Email, Slack or Microsoft Teams | Version 4.18 (Defender alerts, 4.25) |
| Playbook | Other systems, the security operations center or managers | The same events as Nudges | Webhook, email, Slack or Microsoft Teams | Version 4.17 |
What does the person see the instant they click?
The first thing they can see is a Teachable Moment, short content that appears only for whoever has just taken the unsafe action, in the same browser where it happened.
Those seconds are the most receptive ones. The person realizes they made a mistake and wants to know where, so the content points out, on the scam itself, the clues that gave it away. It can end with a validation question to confirm they read it. I have already written about why that is the best time to learn, and the idea still holds.
The action that triggers it is chosen for each campaign. In phishing and smishing it can be the click on the link or the data entry on the landing page. If the simulation uses a QR code, scanning it counts as a click, because each person gets their own code that works as their tracking link, so quishing triggers the same response. In ransomware, the download, the opening of the simulated file or the simulated encryption of the person’s folder. Delivery can be immediate in the browser, immediate plus an email to reread once the surprise has passed, or email only when the campaign ends.
Whoever did not take the action does not receive it, so the program does not add content for the people who did things right.
What happens when the behavior takes place outside the browser?
Many risky behaviors leave no open browser to show anything in. That is where the Nudge comes in, a short message that reaches the person involved by email, Slack or Microsoft Teams, in the channel where they already work.
The triggers cover every component of the platform: Interactive Modules, Videos, Videogames, Newsletters, Exams, Surveys, Phishing, Ransomware and Smishing. And not all of them are mistakes. Reporting a simulation also triggers a Nudge, and so does reporting a real email. That 11% who clicked and still reported deserves a response as much as the click does, because the reporting habit fades when nobody responds.
The reported real email also reaches the reports console. There Smart Triage classifies it automatically as phishing or a false alarm and shows what it found in the sender, the links and the attachments. The final say belongs to a person on the security team, and I wrote about how the work changes when that triage stops being manual in another article.
The biggest difference comes with the Microsoft Defender integration. With it, triggers include real alerts from the organization’s environment, such as a click on a potentially malicious URL or the creation of a forwarding rule in a mailbox. That way the Nudge talks to the person about something that really happened to them. For that, the integration has to be active and people have to be synchronized from Microsoft Entra ID, which is how the platform knows who each alert belongs to.
The platform comes with a gallery of Nudges ready to activate, and each organization can create its own in every language. If you are writing one from scratch, this guide to writing a nudge is a good starting point.
Who else needs to know?
A mistake is rarely only the business of the person who made it. Sometimes a case needs to be opened, the security operations center needs a heads-up, or the person responsible for the area needs to be informed. That is the job of a Playbook, which links a triggering event to one or more actions.
The available actions are a notification by email, Slack or Microsoft Teams, and a call to a webhook into another system, for example the service desk. The webhook supports basic authentication or OAuth 2.0. Before every call the platform requires the address to be HTTPS and to resolve to a public address, so nobody can point it at an internal service.
The triggers are the same as for Nudges, Defender alerts included. That is why a single event can get both responses at once. The Nudge tells the person what happened and what to do, and the Playbook opens the case so the security team does not depend on spotting it on a dashboard. The platform ships with predefined Playbooks that each organization turns on or off.
Alerting a manager makes sense for high-risk behavior. For a first click in a simulation, what the person receives is almost always enough.
What if the click was not made by a person?
Email filters and antivirus tools open links to scan them, and a simulation can record that click as if it were human. If the response went out on the spot, the person would get a message about something they did not do, and the security team would open a case that does not exist.
In Phishing, Ransomware, Smishing and Newsletters, when the organization has the false positive detection window configured, Nudges and Playbooks wait for it to close. If the interaction is reclassified as generated by software during that time, nothing is triggered. Where those automated interactions come from is explained in this article on false positives in simulations.
Is there a record of what was triggered?
Yes. Every execution of a Nudge or a Playbook is recorded, with what was triggered, for whom and with what result. Since version 4.38 Nudges also have their own dashboard, with delivery and its daily trend, opens by channel, the behaviors that trigger the most messages and the sends that failed, exportable as CSV.
That record is what makes tuning possible. If a Nudge is delivered but barely opened by email, it may need to go out through Teams. If a Playbook opens too many cases, the trigger is poorly chosen.
What changes in the report
With this chain, every click opens a path that can be reviewed afterwards, from the event to the action and from the action to the record. If you are evaluating platforms, “What happens after someone falls for it?” is one of the seven questions for evaluating a security awareness platform, together with what to ask to see in a demo.
Leave a Reply