Sharing phishing results without blame
Your phishing simulation results are back. A handful of people clicked, a few entered passwords, and at least one of them is senior enough to make the report awkward. Leadership wants the numbers by Thursday, and the people who clicked don't know yet.
Handle it badly and the clickers feel singled out, trust goes and the next simulation never gets approved. Handle it well and the same people ask for round two, because they now know how convincing that email was.
Gather first: the simulation export with names removed, including who reported the email.
The prompt:
Turn our latest phishing simulation results for a client into a report that strengthens their defenses without blaming anyone, so the next simulation still gets approved.
What experienced security trainers know:
Click rates say more about the lure and the timing than about individual people. A lure that looks like someone's real work catches them, whatever their seniority.
Naming people in a leadership report kills cooperation. Reporting by department and lure keeps the lesson and the goodwill.
The most useful number is often how many people reported the email, and how fast, not how many clicked.
Results with names removed: [department, lure, time sent, time clicked, credentials entered, reported]
Anything sensitive about who clicked: [for example a senior leader or a repeat clicker, or none]
Who will read the report: [owner, leadership team, IT contact]
The training staff already receive: [details]
Do this:
Summarize what the results say about the organization: which lures worked, which departments and times were most exposed, and the reporting rate.
Draft a one-page summary for the reader above with no names, ending on a training plan aimed at the lures and departments that worked, with the follow-up simulation dated.
If anything sensitive is listed above, write talking points for a short private conversation with that person before the report circulates, leading with how convincing the lure was.
If a figure I need is missing from the results, say so instead of estimating it.