What CEO fraud is, why a general phishing simulation doesn’t measure it and how to run a targeted exercise on the people who can move money.
What CEO fraud is, why a general phishing simulation doesn’t measure it and how to run a targeted exercise on the people who can move money.
Since 15 September 2026, Spanish carriers block any SMS whose alias is not listed in the CNMC registry. What that means for smishing and vishing simulations.
Failure rates in phishing simulations range from 1.8% to 30.8% depending on the lure. So what does a repeat-clicker list measure, and what can you do with it?
Awareness plans are usually split by department, the criterion that ages worst. Which criteria hold up a plan by audience, and how to build the calendar.
Targeted plans cover the areas with a risk hypothesis. What coverage is left for the rest of the organization, and which indicator you can actually report.
Your own incident is the strongest awareness material an organization has. What to tell, what to strip from the account and when to tell it.
Which phishing reporting metrics program owners watch, how the report gets back to the person who sent it, and the two numbers that answer the board.
Self-efficacy predicts secure behavior better than knowledge does, and no awareness dashboard tracks it. What the evidence says and what a program can decide.