Most security training exists to satisfy a requirement. It happens annually, takes forty minutes, and produces a certificate. Almost none of it changes what someone does when a convincing message arrives eight months later. A smaller set of practices does considerably better.
Make reporting frictionless and blameless
The single most valuable behaviour is fast reporting — including from people who already clicked. If reporting feels like confessing, it happens hours later or not at all, and those hours are when an attacker consolidates access. Provide a one-click report button, respond with thanks rather than interrogation, and make it explicit that nobody is disciplined for reporting a mistake. Praise the report publicly and handle the incident quietly.
Teach your attacks, not generic ones
Show real examples aimed at your organisation with the identifying details removed. A supplier invoice with changed bank details is far more instructive to a finance team than an abstract lesson about phishing. Tailor content by role: finance needs payment-verification discipline, engineers need credential handling, everyone needs reporting.
Short and frequent
Five focused minutes every month outperforms forty minutes once a year, because recognition depends on recency. Keep each session to one behaviour and one reason it matters.
Use simulations carefully
Phishing simulations are useful for practising the reporting reflex and diagnosing where support is needed. They become counterproductive when used punitively or when they exploit emotionally charged subjects such as bonuses or redundancies — those erode trust in internal communications, and trust is the thing you are trying to build.
Measure the right number
Click rate is the popular metric and the less useful one. Track median time to report instead, and the proportion of incidents that were reported by a person rather than detected by tooling. Those numbers describe your actual resilience, and they improve when the culture is right rather than when the training is longer.