Should awareness programmes prioritise email phishing or multi-channel simulation?

Why phishing training should cover more than email

Email is still the most common delivery route for pretexting, but it is no longer the full attack surface. A realistic awareness programme should train people to recognise the same social engineering pattern across email, SMS, voice, collaboration tools, and consent flows, because the attacker’s objective is usually to move the target toward one action, not to stay inside one channel.

That matters for detection as much as for behaviour change. If employees only learn to question email, they can still be vulnerable when a message is reinforced by a phone call, a text, or a follow-up in a chat app that appears to confirm the original request. Multi-channel simulation helps people learn the cue pattern, urgency, authority, and verification steps, rather than just the visual signs of a suspicious email.

Good programmes also reflect how adversaries chain channels. A message may arrive by email, be validated by a text, and be completed over a call or through a login page. Training that mirrors that flow is more likely to improve reporting and challenge behaviour than one that treats phishing as a mailbox problem.

What changes when simulation is multi-channel

Multi-channel simulation changes the exercise from “spot the bad email” to “verify the request across the path the attacker used.” That is a more useful control objective because it tests whether users pause, escalate, or independently verify before acting. It also surfaces which parts of the workforce are susceptible to voice pressure, SMS urgency, or platform trust, which email-only exercises will miss.

This broader scope does not mean email becomes unimportant. Email often remains the primary lure or starting point, and it is still worth testing. The difference is that email should be one component of a wider programme, not the whole programme. If the organisation has high-value workflows that can be approved by chat, voice, or mobile prompts, those channels should be included in the simulation design.

Simulation design should also avoid training to the test. If every exercise is obvious email fraud, people learn the narrow pattern rather than the underlying decision rule. A stronger approach is to vary the channel and the pretext while keeping the expected employee response consistent: slow down, verify out-of-band, and report through the approved path.

How to set the priority in practice

Prioritise multi-channel simulation when your workforce uses mobile messaging, voice callbacks, or collaboration platforms for approvals, access requests, finance actions, vendor contact, or urgent escalations. That is where the risk is most likely to transfer from email into a broader social engineering chain.

Keep the exercises aligned to real business exposure. A finance team may need simulated invoice fraud across email and phone, while a service desk may need requests that move from email to chat to password reset. The channel mix should match the attack paths that would actually create loss, not a generic annual awareness script.

• What to measure: report rates, verification rates, and how often users stop the action before the final handoff.
• What to verify: whether users challenge requests that arrive through a second channel after the first lure.
• Common mistake: treating “phishing awareness” as a single email click-rate metric instead of a test of social engineering resilience across channels.

Risk and Threat Considerations

The main risk in an email-only programme is false confidence. Attackers can bypass mailbox skepticism by moving the same pretext into text, voice, or collaboration channels, where users may apply different trust assumptions and fewer verification habits.

Failure mechanism: the employee learns to distrust suspicious email formatting, but still accepts a believable message when it is reinforced by a call, SMS, or chat request that appears to confirm legitimacy.

Impact: the organisation preserves a narrow awareness metric while leaving the real social engineering path intact, which can increase the chance of credential theft, fraudulent payment, or unauthorised approval.

Practitioner Guidance

Decision rule: if employees can complete a sensitive action through more than one channel, the simulation should cover more than one channel. Email-only training is acceptable only when email is genuinely the only operational path into the targeted workflow.

What to prioritise: start with the channels that are already used to trigger action in your business, especially mobile messaging and voice for urgent requests, then add collaboration tools where approvals or support interactions happen.

What good looks like: users recognise the request pattern, verify it through an independent route, and report it regardless of whether the lure arrives by email, text, or call.

Practitioner takeaway: the right unit of defence is not the inbox, it is the social engineering path. Train people to question the request across channels, and the programme becomes far more aligned with how attacks actually unfold.

Related resources from NHI Mgmt Group

• How should security teams evaluate phishing simulation programs in a multi-channel threat environment?
• What breaks when phishing programs focus only on email instead of multi-channel attack scenarios?
• How should security teams prioritise NHI remediation in cloud environments?
• What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?