Writing · Security operations

Training lowers the click rate. Detection catches the rest.

Every phishing program eventually hits the same wall. Training gets better, the click rate drops, and then it stops dropping. It never reaches zero.

That's not a training failure. It's the reason phishing defense has to be layered.

Layer one: people

Generic annual training wasn't changing behavior, so we replaced it with targeted, automated training based on each person's own mistakes. We made reporting a suspicious email a one click habit, because a report tells the security team a campaign exists. A delete tells them nothing.

The requirement applied to everyone, leadership included. When some senior leaders weren't completing it, we didn't relax the rule or chase people one by one. Training went into the employee handbook everyone signs each year, and an automated report of non completions went to HR.

Repeat phishing mistakes fell 75% in 10 months.

Layer two: detection and response

75% fewer repeat mistakes still isn't zero. So behind the people sat a SOC as a Service with SIEM and XDR coverage, watching 24x7 for the behavior that follows a bad click.

Over five years, it contained the impact of more than 100 phishing and human error incidents before any of them became a major incident.

The result

Zero major security incidents across nine years. No single control did that. Training reduced how often something got through, and detection made sure that when it did, it stayed small.

Training lowers the click rate. Detection catches the rest. You need both.

Which layer does your program lean on most, and which one would you invest in next?

← More writing