Phishing Failures: How Not to Phish Your Users

This blog by Javvad Malik and Erich Kron explains how to run effective, compassionate phishing simulations and security awareness training to build reflexive defenses against modern social engineering. It advocates frequent, engaging exercises with positive reinforcement, careful topic selection (avoiding sensitive lures), gamification, and a focus on learning over punishment to boost reporting, reduce errors under pressure, and strengthen organizational security culture.