Notifications
Clear all
Topic starter
21/08/2026 4:58 pm
TL;DR: Enterprise phishing simulation programs often plateau because repeated templates train recognition, not safer behaviour, and Living Security’s guide argues that large organisations need Human Risk Management, multi-channel testing, and behavioural signals to predict where human error will appear next. Simple click rates are no longer a reliable proxy for risk, and the governance problem now is measuring exposure that evolves faster than awareness campaigns.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: Enterprise Phishing Simulation: A Program Design Guide
By the numbers:
- 71% of working adults admit to taking risky actions even when they know the dangers.
- The ratio of non-human to human identities now exceeds 100:1 in enterprise environments.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How can teams keep phishing simulations from harming trust?
A: Be transparent about the existence of simulations, explain their educational purpose, and avoid public shaming or performance punishment.
Q: Why do repeated phishing templates stop reflecting real risk?
A: Repeated templates teach employees the shape of the exercise, so the programme measures memory rather than resilience.
Q: What signals show a phishing programme is not improving security?
A: Look for flat click-rate trends, low scenario diversity, poor correlation with actual incidents, and no behavioural change across repeat tests.
Practitioner guidance
- Define a simulation baseline by role and channel Measure phishing response separately for email, SMS, voice, and QR code scenarios, then segment results by business role and privilege level so the programme reflects actual exposure patterns rather than one company-wide average.
- Replace repetitive templates with scenario libraries Use a rotating library of realistic scenarios tied to common workflows, external threats, and current fraud patterns so employees are tested on decision-making, not memory of a familiar template.
- Connect simulation data to identity workflows Send high-risk user outcomes into IAM, PAM, and SOC processes so repeated risky behaviour can trigger access review, coaching, or step-up verification where appropriate.
What's in the full article
Living Security Human Risk Management Platform's full blog covers the operational detail this post intentionally leaves for the source:
- The full scenario design guidance for building an enterprise phishing simulation library across email, SMS, QR code, and voice.
- The platform-specific approach to weighting behaviour, identity, and threat signals when scoring human risk.
- The monthly operating rhythm for reviewing outcomes, adjusting difficulty, and triggering targeted follow-up actions.
- The article’s examples of how Living Security positions automation for routine tasks inside a Human Risk Management workflow.
Enterprise phishing simulation plateau: what do teams do next?
Explore further
21/08/2026 5:14 pm
Template fatigue is a governance failure, not a training success. When simulation results flatline, the problem is usually not that the workforce has become safer. It is that the exercise has become predictable enough to train the test rather than the behaviour. That makes click-rate reporting a weak proxy for true risk reduction, especially when attackers adapt faster than awareness calendars. Practitioners should treat repetitive testing as a measurement defect, not a maturity milestone.
A question worth separating out:
Q: How should organisations connect human risk data to IAM decisions?
A: High-risk simulation outcomes should inform access review, step-up checks, and targeted intervention when risky behaviour repeats. That does not mean every click becomes an access event, but it does mean identity teams can use behavioural evidence to prioritise attention where exposure is persistent.
👉 Read our full editorial: Enterprise phishing simulation still measures memory, not risk
