Reporting phishing without humiliating staff
Named-and-shamed click lists kill the programme. Report trends. Thank the people who forward mail.
ITSIGN Administrator · May 21, 2025 · 2 min read
If the only time security talks to the floor is to publish who failed, people will hide the next click.
Show cohorts. Show the trend. Call the person who reported a real one.
That is how we run security awareness training. The metric is reports and callback compliance, not a humiliation score.
Related reading
Awareness training for hybrid and remote teams
Home routers, family PCs, and coffee-shop Wi-Fi are part of your estate whether you like it or not.
2 min read
Building a report-it culture
The best control you do not have to licence: staff who forward the weird mail in under two minutes.
2 min read
Why the annual security video fails
People click complete. Attackers do not wait for your LMS calendar.
2 min read
Want this applied to your environment?
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.