An A–Z reference guide to the key concepts, behaviours, and terminology around human cyber risk — from accountability to zero trust.
Accountability in information security means that every action taken on a system, network or dataset can be traced to an individual or entity. It is one of the main reasons why access controls and identity management exist — to ensure that when something goes wrong, the trail leads somewhere. Without it, breaches go un-investigated and bad behaviour goes unchecked.
Coaching and remedial training reinforce that individuals own the consequences of their security behaviours. When people understand why their actions matter, accountability shifts from a disciplinary concept to a cultural one.
Account takeover occurs when an attacker gains unauthorised access to a legitimate user's account, typically by stealing credentials. Phishing is its most common enabler — by tricking users into surrendering passwords or clicking malicious links, attackers bypass technical controls entirely and operate as a trusted insider, making detection far harder than a conventional intrusion.
SecureClick's remedial phishing training teaches users to recognise the hallmarks of phishing such as suspicious links, spoofed senders, and urgency tactics before they surrender the credentials that make account takeover possible.
AppLocker is a Windows application control policy tool that allows IT administrators to restrict which applications, scripts and executables users can run, based on rules tied to file path, publisher or hash. Its appeal is obvious — if users cannot run unauthorised software, the attack surface shrinks considerably.
But over-reliance on it is dangerous for several reasons. AppLocker operates on rules, and rules can be misconfigured, circumvented or rendered obsolete by legitimate software updates. Sophisticated attackers routinely find living-off-the-land techniques exploiting trusted, whitelisted system tools like PowerShell that AppLocker was never designed to stop. More fundamentally, over-reliance on any single technical control breeds the illusion of security. It can cause organisations to underinvest in user awareness, behavioural monitoring and layered defences, assuming the perimeter holds.
Andragogy is Malcolm Knowles' theory of adult learning, distinguishing how adults learn differently from children. Where pedagogy assumes a dependent learner who absorbs what they are taught, andragogy holds that adults are self-directed, bring existing experience to learning, need to understand why something is relevant before engaging with it and are motivated by practical application rather than abstract knowledge.
Knowles held that adults learn best when they understand why something matters to them personally, when training connects to their real experience and when they are treated as self-directed learners rather than passive recipients of instruction. A generic, compliance-driven security module delivered annually violates almost every one of his principles.
For repeat offenders, Knowles would ask whether the training ever made the threat feel real and relevant to that individual's role and context. If someone keeps clicking, the content likely failed to connect with the learner. He would advocate for personalised, experience-based remediation that respects the learner's intelligence, addresses their specific vulnerability and gives them ownership of their own security behaviour. Punishment and repetition, in his framework, are not just ineffective — they are counter-productive in reducing your cyber risk.
John Keller, whose ARCS model of motivational design is widely used in instructional design, would approach repeat clickers as a motivation problem before a knowledge problem. ARCS stands for Attention, Relevance, Confidence and Satisfaction.
Keller would apply each dimension to diagnose why training is failing:
For repeat clickers, Keller would likely identify relevance and satisfaction as the critical failures. A user who keeps clicking is not resisting security; they are responding rationally to training that never gave them a genuine reason to do otherwise.
Users who are given genuine understanding and trusted to make informed decisions — rather than instructed to follow rules — develop autonomy or ownership over their own security behaviour. Autonomy, once established, is self-reinforcing in a way that no extrinsic programme ever manages to be.
Users can only respond to things they are aware of. Awareness is the starting point but it has never been enough to stop a breach. The proof is your repeat clickers: they sat through the training, they know the risks — but they still clicked.
That gap between knowing and doing is where your greatest human risk lives, and where traditional security awareness programmes consistently fall short. Our coaching closes that gap. We work with each individual to uncover and address the root cause of their behaviour, turning your most vulnerable users into your most resilient ones.
A training baseline is needed for repeat clickers because without it you are trying to fix a problem you have not properly measured or understood. A baseline establishes where an individual actually sits in terms of their current susceptibility, knowledge gaps and behavioural patterns before any intervention begins.
This matters because not all repeat clickers are repeat clickers for the same reason. One person might lack basic technical knowledge, another might be highly knowledgeable but work under chronic time pressure, and another might have deeply ingrained habits that no amount of awareness has yet disrupted. Treating them all with the same intervention without a baseline is guesswork.
This is exactly the approach SecureClick takes, using pre-training diagnostic surveys to establish that baseline before any learning begins. We also run post-training diagnostic surveys to measure what has genuinely shifted. Without this kind of structured measurement you cannot tell whether training is actually working or whether someone is simply getting better at completing exercises without changing their real behaviour.
Trusting communications based on familiar appearance rather than confirmed authenticity. Through coaching, individuals learn to question assumptions constructively and build verification into their workflow. This lowers the risk of incidents such as "internal phishing" where often the email address of the sender is perfectly legitimate.
A ClickFix attack is a social engineering technique that tricks users into executing malicious code themselves, typically by presenting a fake error message or CAPTCHA that instructs them to copy and paste a command into their terminal or browser. The user believes they are fixing a problem; they are in fact delivering the payload.
Its potency lies in self-execution. Because the user performs the action voluntarily, traditional controls such as email filters, application whitelisting, and endpoint detection are largely bypassed. The command runs under the user's own permissions, appears intentional to monitoring systems, and leaves little to distinguish it from legitimate administrative activity. AppLocker, Microsoft Defender, Proofpoint, Mimecast and similar tools offer minimal protection because the user is the delivery mechanism.
Targeted training helps by building scepticism around unsolicited instructions. Users who understand that no legitimate website, update prompt or CAPTCHA will ever ask them to run a terminal command are far harder to exploit.
Conditional access is a valuable technical control, but for repeat clickers it treats the symptom rather than the cause. Consider a common Microsoft 365 scenario where a repeat clicker triggers a risk signal by signing in from an unfamiliar location after clicking a phishing link. Conditional access may block that session or prompt multi-factor authentication, but by that point the user has already engaged with the malicious content and the damage may already be done.
The policy responds to the anomaly but has no mechanism to address why that individual clicked in the first place. Furthermore, conditional access is built around signals like device compliance, network location and sign-in patterns rather than behavioural risk, meaning a repeat clicker operating from a compliant device on a trusted network will pass every check without question.
Without targeted coaching and intervention running alongside these technical controls, the behavioural pattern remains unchanged and the risk resurfaces the moment restrictions are lifted.
Confirmation bias occurs when the user focuses on details that align with their expectations (e.g., "Yes, I was waiting for that invoice") while overlooking red flags. We have come across cases where even IT managers themselves have got caught out by confirmation bias.
Our remedial cyber coaching trains individuals to actively question convenient narratives and perform out-of-band verification before acting.
Constructive feedback transforms behaviour because it separates identity from action — a distinction Douglas Stone and Sheila Heen emphasise in Thanks for the Feedback. Employees resist criticism when it feels like personal judgment, but accept it when framed as correctable behaviour.
Effective feedback is specific, timely and forward-looking: it explains what went wrong, why it matters and how to improve. In security contexts, telling someone "you clicked a phishing link" is accusatory. Explaining "here are the warning signs you missed and here is how to spot them next time" is constructive. The difference in approach determines whether people learn or merely resent.
The COM-B model argues that behaviour occurs only when three conditions align:
In security awareness, it is a diagnostic tool. If users keep failing, the COM-B model asks which element is missing before prescribing a solution. Fogg's Behaviour Model similarly requires Motivation, Ability and a Prompt to converge, but is more trigger-focused. The critical difference: Fogg tells you when to prompt; COM-B tells you why people still fail after you do. For repeat offenders and neurodiverse users especially, COM-B's diagnostic depth is considerably more useful.
A cue is a signal or trigger — conscious or subconscious — that prompts a reaction or decision. Cyber attackers exploit this by manufacturing false trust cues: spoofed cloud applications, email addresses that look almost identical to legitimate ones, urgent language from a "manager," or even a padlock icon in a browser.
When it comes to repeat clickers, they tend to be empathetic, task-focused, or working under pressure, meaning they're primed to respond quickly to signals that look like a legitimate request.
Two actionable tips:
IT specialists such as system administrators, helpdesk and SOC staff — fluent in technical jargon — often struggle to successfully communicate with colleagues who can't grasp basic concepts of information security. This can result in impatient technical staff and baffled users.
SecureClick breaks this curse: we anticipate confusion, translate techspeak into plain English and patiently guide repeat clickers and other high-risk users through fundamentals in a relatable way without condescension.
Credential theft is a far broader and more silent threat than most employees appreciate. A significant proportion of credential theft never involves organisational systems at all — it begins elsewhere, on a fitness app, a retail account, a news subscription — any third-party site where an employee has registered using their work email address and, critically, a password they re-used.
When that site is breached, the stolen credentials are aggregated, sold on criminal marketplaces and systematically tested against corporate login portals in a technique known as credential stuffing. The employee never received a suspicious email. They never clicked anything they should not have. They simply reused a password — and that was enough.
SecureClick's coaching helps by moving the focus away from recognising specific attacks and toward building the everyday cyber hygiene habits that prevent silent compromise before it begins.
Phishing-prone employees need to understand what the organisation's critical assets actually are because abstract warnings about cybersecurity rarely change behaviour in a lasting way. When someone genuinely understands that their actions could expose customer data, intellectual property, financial records or operational systems the entire business depends on, the stakes become real and personal rather than theoretical.
To foster this mindset there are three practical steps worth taking:
Cyber espionage is the covert use of digital techniques to infiltrate systems and extract sensitive information without the target's knowledge, typically for political, military, or economic advantage. Unlike financially motivated attacks, the goal is intelligence gathering rather than immediate disruption or profit.
Cyber espionage is not just a government problem. Private sector digital assets such as intellectual property, strategic plans, and confidential communications are a high-value target. Consider what a competitor could gain by compromising a single CRM system or email account — confidential tender details, live deal negotiations, client pricing, strategic plans.
Unlike ransomware, cyber espionage makes little or no noise. There is no system outage, no ransom note, no obligation to disclose. The most effective defence is not a more sophisticated technology stack. It is people whose habits and instincts make them significantly harder to compromise.
Cyber hygiene refers to the routine practices that maintain the security of systems and users — patching software, managing passwords, controlling access and recognising threats. Like personal hygiene, its value lies in consistency; small habits performed reliably prevent large problems.
NIS2, the EU's updated Network and Information Security directive, elevates cyber hygiene from best practice to legal obligation for organisations in critical and important sectors. Senior management are held personally accountable for compliance, and employee training is a baseline expectation, not an option.
Targeted training bridges the gap between policy and practice by tailoring security awareness content to the role, risk profile and individual learning need.
Data exfiltration is the unauthorised transfer of an organisation's information into an attacker's hands. It is the ultimate objective behind most corporate cyberattacks — and in the overwhelming majority of cases, the door through which that data escapes was opened not by a sophisticated technical exploit, but by an employee who clicked something they should not have.
Technical controls help. Multi-factor authentication, conditional access policies and data loss prevention tools can lower your risk. But none is impenetrable, and all can be undermined by a single employee who hands an attacker legitimate credentials at the wrong moment. The organisations best equipped to resist data exfiltration invest as seriously in training their people as in hardening their systems.
Data loss prevention (DLP) systems — such as Microsoft Purview, Symantec DLP, Forcepoint and Broadcom — monitor outbound email, flag unauthorised cloud uploads and alert administrators when sensitive data moves beyond the perimeter.
DLP tools operate on rules and patterns. They work well against the unsophisticated. Against a determined attacker they frequently do not. An adversary who has harvested an employee's Microsoft 365 credentials via a convincing phishing email can log into SharePoint, browse methodically and exfiltrate sensitive data in modest, unhurried batches — well within the thresholds that trigger automated alerts.
This is the fundamental limitation: DLP cannot distinguish between a legitimate user and an attacker using stolen credentials. The most powerful protection against data exfiltration is not a tool or a platform. It is the person at the keyboard.
Conditioning repeat clickers to use intentional pause-points before opening suspicious downloads or attachments helps build micro-moments of reflection that interrupt autopilot behaviours at critical junctures.
What makes SharePoint-style checkpoints particularly dangerous is the combination of familiarity, authority and low perceived risk. SharePoint requests are routine, appear to come from known colleagues, and seem to require only a minor action. Those three conditions together are precisely where social engineering is most likely to succeed and scrutiny is least likely to occur.
Delegated access occurs when a user grants another person or application permission to act on their behalf — sharing credentials, assigning admin rights or authorising OAuth tokens. It is common, necessary but sometimes risky.
Its danger lies in its erosion of accountability. Actions taken under borrowed identity blur the audit trail, and a compromised delegate inherits every permission the original user held, appearing entirely legitimate to monitoring systems.
Most phishing training is stuck in single-loop thinking: someone clicks a bad link, resits the generic security awareness training, and clicks another one next month. The organisation responds by doing more of the same.
Chris Argyris's theory of double-loop learning exposes the core failure. Standard training addresses what people say they believe about security while ignoring how they actually behave under pressure. Repeat offenders are not ignorant; they are busy, cognitively overloaded and operating in cultures where pausing to scrutinise an email feels professionally costly.
Argyris would also flag the perverse effects of "gotcha" phishing simulation programmes. Shaming repeat clickers triggers defensive routines, causing people to focus on avoiding embarrassment rather than genuinely understanding risk. You get compliance theatre, not behavioural change.
Dwell time is the period between an attacker gaining access and being detected — globally, this averages over 190 days. During that window, attackers move laterally, escalate privileges, and exfiltrate data largely undetected.
What shortens that window most effectively is often a user noticing something feels wrong — an unusual login, unexpected system behaviour, a suspicious callback request — and knowing exactly what to do with that observation.
Organisations that treat their people as an active layer across the full NIST framework consistently demonstrate stronger security outcomes. Your users aren't just potential victims. Trained correctly, they are one of your most responsive and adaptive security controls.
Recognising that phishing weaponises urgency, fear, and excitement. SecureClick's remedial cyber security training develops your users' ability to notice emotional hijacking and respond from a position of calm and control rather than panic.
Learning why "looking safe" doesn't mean "being safe." A link to a OneDrive file might look reassuringly familiar — but this is where users can get caught. Our remedial cyber security awareness training helps users such as repeat clickers question their assumptions and verify even when everything feels familiar and legitimate.
Giving robust feedback to repeat clickers can significantly enhance organisational resilience. The process involves:
GDPR (General Data Protection Regulation) is the EU's landmark data privacy law, introduced in 2018, which governs how organisations collect, store, process, and protect personal data. However, GDPR is fundamentally a data governance law, not a human behaviour law — and that distinction matters enormously when it comes to phishing and social engineering.
GDPR tells organisations what to do with data. It says very little about training people to recognise when they are being manipulated into handing it over. Its training requirements are vague, typically satisfied by a once-a-year policy awareness exercise that teaches staff about data handling rules rather than how to spot a convincing impersonation email.
The result is a workforce that is technically "GDPR trained" but entirely unprepared for a well-crafted phishing email, a pretexting call, or a WhatsApp message impersonating their CEO.
When users are fixated on completing a task — sending that report, clearing their inbox, meeting a deadline — they can become blind to threats along the way. Coaching helps users recognise when goal pressure narrows their attention, building the habit of pausing to assess even when urgency screams "just get it done."
Habits are a double-edged sword when it comes to cyber threats. On the negative side, habits are exactly what attackers rely on. When we do something repeatedly it moves into automatic behaviour, meaning we stop scrutinising it.
This is where curveball social engineering attacks become particularly dangerous. A curveball attack deliberately breaks from the patterns your habits are trained to detect — arriving as a casual message from an apparent new colleague, a voice note, or a USB drive left in a car park.
On the positive side, good security habits are still one of the most powerful defences available, provided they are broad enough. If verifying unexpected requests through a separate channel and questioning anything that asks for access or credentials — regardless of format — becomes second nature, you build resilience even against curveball scenarios.
Repeat clicking is so hard to break through conventional training because every time someone rapidly processes and acts on an email without scrutiny, that neural pathway gets stronger. Donald Hebb's principle that "neurons that fire together wire together" explains why phishing emails are so effective at hijacking well-worn neural pathways.
The implication for remedial security training is significant. You cannot simply inform your way out of the problem. New neural pathways need to be built through repeated, contextualised practice until careful scrutiny itself becomes the automatic response. This means frequent, low-stakes, realistic exercises rather than annual awareness modules.
The human brain uses mental shortcuts to process repetitive tasks efficiently, but these same shortcuts make humans vulnerable. Coaching helps users such as repeat clickers recognise when heuristics (like "internal email = safe") are being weaponised, teaching strategic slowdowns at critical decision points.
A High Value Target (HVT) refers to any user, system, or asset within an organisation that would provide a significant advantage to an attacker if compromised. From a human risk perspective, HVTs typically include:
HVTs are disproportionately targeted because compromising one can give an attacker elevated privileges, lateral movement opportunities, and access to sensitive data far beyond what a standard user account would provide. A generic awareness programme is not an appropriate risk control for someone whose compromise could result in a material financial loss, a regulatory breach, or serious reputational damage.
Developing practical methods to confirm who's really contacting you. Our repeat clicker training builds the habit of verifying suspicious requests using independent (out-of-band) channels rather than responding directly.
Indicators of Compromise (IoCs) are observable signs that a system or network has been breached or is under attack. Common examples include:
Automated security tools can be useful but cannot catch everything. A security-aware workforce transforms every employee into a sensor, closing gaps that technology leaves open. For example, an unexpected MFA prompt that the user did not trigger is an immediate red flag — a trained user knows never to approve it and to report it straight away.
An infostealer is a category of malware designed to silently harvest credentials, session tokens, browser data, cryptocurrency wallets and other sensitive information from an infected device, before exfiltrating it to an attacker.
Infostealers are cheap, widely available on criminal marketplaces and require little technical sophistication to deploy. They frequently arrive through seemingly innocuous behaviour such as downloading a cracked application, clicking a malicious ad, or installing a browser extension.
Training that connects everyday habits — reusing passwords, installing unvetted software, ignoring endpoint alerts — to their real-world consequences is the most effective defence.
Assuming someone else's inner reality can lead to misunderstandings and mis-judgments, as each person's thoughts and feelings are unique. Many IT managers design security policies around an idealised, technically literate user, failing to account for the reality that most people are time-pressured, distracted and motivated by convenience over caution.
Moreover, neurodiverse users may process security prompts, warnings and training material very differently — meaning controls that seem obvious to a specialist are routinely bypassed or ignored by everyone else.
Incident reporting is the earliest point at which an organisation can interrupt an attack before it escalates into a breach. A prompt report from an employee who received a suspicious email or noticed unusual account behaviour can trigger a response that prevents a minor event from becoming a major incident.
Security awareness training is the primary mechanism for building a reporting culture. Employees who understand what to look for, believe their reports will be taken seriously, and know exactly how to escalate are measurably faster to respond. That speed is itself a quantifiable business control, directly compressing the window an attacker has to operate undetected.
Between our remedial phishing coaching sessions is when the real learning often happens. This is when the coachee consciously tries out different ways of doing things — for example, they might try out one of our structured approaches for processing emails. This puts the learning into practice and helps cement secure information security behaviours.
A job aid is a simple, practical reference tool that guides someone through a task or decision at the moment they need it — rather than relying on them to remember training they received weeks or months earlier. It could be a checklist, a flowchart, a prompt card, or a short decision tree.
In the context of phishing, a job aid might be a laminated card next to a keyboard, a desktop wallpaper, or a pinned note on a screen that reminds someone what to check before clicking a link or responding to an unusual request. A well-designed job aid externalises the "if-then" structure that Peter Gollwitzer argues the brain needs — for example: if I receive an urgent email requesting login credentials, then I will check the sender address and call the person directly before acting.
The repeat clicker problem cannot only be attributed to what the user knows. There is sometimes a wide distance between knowledge and security behaviours that most security training programmes don't fully acknowledge.
Clicking is fast and automatic; intention is slow and deliberate. Without specific if-then behavioural scripts rehearsed in advance, the intention to be careful has no mechanism to intervene in the moment that matters. Training that builds and practises implementation intentions — rather than simply reinforcing awareness — gives the user something concrete to deploy in precisely the moments when deliberate thought is least available.
Most phishing training is built for one type of learner and delivered in one way — typically passive e-learning modules. Peter Honey and Alan Mumford, building on David Kolb's experiential learning theory, argued that meaningful behaviour change requires experience, reflection, conceptualisation and active experimentation. Standard phishing programmes skip almost all of that.
The practical implication is straightforward: vary the intervention. A repeat clicker needs a conversation about their specific context, hands-on exercises and examples drawn from their own role — not another generic module. Treat the person as an individual with particular learning needs rather than a compliance checkbox.
Making URL checking automatic, not occasional. Our remedial security awareness training transforms link verification from a chore into a quick, reflexive habit. This is critical because authentic-looking URLs can be sophisticated fakes — just one character off, a different domain extension, or a threat actor exploiting the outbound email functionality of a trusted cloud service.
However, there is an important caveat. Link inspection operates on the premise that threats arrive via suspicious or unfamiliar sources. When an attacker has compromised a legitimate account, communications originate from a trusted sender, pass authentication checks and arrive with the full credibility of an established relationship — the usual triggers of suspicion are absent.
Meeting users where they are is the foundational principle that most security awareness programmes ignore. It requires understanding not just what a user knows, but how they process information, what pressures shape their working day and what barriers stand between their current behaviour and the one the organisation needs.
For managers, three actionable responses follow:
Malicious compliance is following information security rules to the letter and not the true spirit or guiding principles of information security. It is counterproductive because it creates the illusion of a secure culture while leaving every underlying vulnerability intact.
Multi-tasking splits user attention across competing demands, creating the perfect conditions for phishing to slip through. Our remedial training helps users recognise when divided attention compromises security judgment.
For managers, several practical responses follow:
Recognising the stories attackers tell to manipulate users and how they engineer channel switches to maintain control of the narrative. SecureClick's one-to-one phishing coaching sharpens users' ability to spot when someone crafts a compelling story that conveniently moves them from email to SMS, or from email to phone — a classic tactic that isolates users from security controls and prevents verification through normal channels.
Near-miss bias in phishing occurs when an employee clicks a risky link, suffers no consequences, and concludes their judgment was sound. Rather than thinking "I got lucky," they think "It wasn't really dangerous." Absence of disaster becomes evidence of competence, when it merely reflects luck.
This sabotages training, breeds overconfidence and discourages reporting. The asymmetry is stark: attackers need succeed only once; defenders must be right every time. Organisations can counter this with immediate feedback spelling out what could have happened.
Neurodiversity — the natural variation in how human brains process information, encompassing conditions such as ADHD, dyslexia, and autism — may hold the key to understanding one of cybersecurity's most frustrating puzzles: why some users keep falling for the same threats, again and again.
An impulsive click on a phishing link may not be recklessness but ADHD; missing a spoofed email address may not be carelessness but dyslexia; falling for a manipulative request may not be naivety but an autistic tendency to take instructions at face value.
Security leaders are beginning to recognise that repeated risky behaviour is less a people problem and more a design problem. The solution demands inclusive, varied, and personalised training over the jaded cycle of blame and retrain.
NIS2 (Network and Information Systems Directive 2) is the European Union's updated cybersecurity law, which came into force in 2023 and applies to tens of thousands of organisations across critical sectors including energy, healthcare, transport, and digital infrastructure.
Its central message is simple: cybersecurity is no longer purely a technical matter. It is a leadership responsibility with legal teeth. The directive explicitly mandates that all employees, including senior management, undergo regular cybersecurity training.
Under Article 20, management bodies must not only approve and oversee cybersecurity risk management but participate in training themselves — with fines of up to €10 million and even temporary bans from management roles for non-compliance.
The National Institute of Standards and Technology Cybersecurity Framework is a widely adopted framework that gives organisations a structured approach to managing cybersecurity risk. The framework is built around six core functions — Govern, Identify, Protect, Detect, Respond, and Recover — and security awareness sits firmly within the Protect function.
The most important thing NIST CSF tells us is that cybersecurity is a continuous cycle, not a one-time event. Too many organisations treat security awareness as an annual compliance exercise. NIST CSF explicitly rejects this thinking — threats evolve, people forget, and new employees arrive, meaning awareness must be ongoing, measured, and adapted over time.
OAuth phishing is an attack technique that exploits the trust users place in legitimate authorisation flows. Rather than stealing a password directly, attackers create malicious applications that mimic credible services and trick users into granting them OAuth permissions — effectively handing over access to email, files or contacts through an entirely legitimate-looking process.
Its danger is precisely its legitimacy. Because the user clicks through a genuine OAuth consent screen — often hosted on a real platform like Google or Microsoft — there is no fake login page to detect, no credential to steal and no obvious red flag to trigger suspicion. Multi-factor authentication offers no protection; the attacker never needs the password at all.
Office 365 / Microsoft 365 phishing succeeds because it exploits familiarity. Employees see Microsoft login screens dozens of times daily, making them less likely to scrutinise a fake one. Attackers replicate the interface of applications such as SharePoint and OneDrive with precision.
A Microsoft 365 component like Teams can be leveraged by threat actors as an unexpected and powerful attack vector — it's already trusted by users and has limited monitoring by technical controls. Moreover, these attacks bypass traditional email filters by hosting malicious pages on legitimate platforms. The psychological advantage is decisive: people trust what looks normal.
Effective IT security requires employees to feel accountable for their actions, not merely compliant with rules. When staff view security as someone else's problem — "that's IT's job" — they become passive and inattentive.
Ownership transforms this dynamic. Employees who understand that a single careless click can compromise colleagues' data, disrupt operations or expose customers become invested in vigilance. Organisations can cultivate this sense of shared responsibility through transparent communication about threats, involving staff in security decisions and treating incidents as learning opportunities.
Secure management of passwords is critical because people must still make fundamental security decisions — choosing which accounts need unique passwords, recognising when credentials might be compromised, and knowing when to change passwords after a breach.
Password managers are powerful tools but aren't enough because they don't address the human element. Users can still choose weak master passwords, reuse passwords across the manager and other services, fall for phishing sites that steal credentials before the manager even engages, or fail to enable multi-factor authentication.
Security coaching helps users understand password best practices like creating strong passphrases, avoiding reuse, recognising phishing attempts targeting credentials, and being on the lookout for password manager "updates."
Peer norms are the unwritten standards of behaviour that define what is considered normal, acceptable or expected within a group. In the context of phishing and repeat clickers, peer norms are enormously consequential. If the prevailing attitude in a team is that security training is a bureaucratic nuisance, individuals will conform to that standard regardless of what the policy manual says.
Robert Cialdini's research is instructive: in his "hotel towels" experiment, people don't just follow rules — they follow people. If employees believe risky behaviour is normal, it becomes normal. But flip that narrative and show people that most colleagues do follow safe practices — the behaviour follows, not through fear, but through the instinct to fit in.
A phishing simulation is a controlled exercise where an organisation sends fake phishing emails to employees to test whether they click malicious links or submit credentials. However, research has increasingly questioned their effectiveness as a standalone intervention.
Studies published in journals including IEEE and ACM have found that click rates on simulated phishing emails show little sustained reduction over time. Critically, simulations teach recognition of a specific lure format rather than building transferable judgement. There is also a cultural cost — employees who feel surveilled or embarrassed by failure become less likely to report genuine incidents.
A human-led targeted intervention addresses these gaps by developing genuine critical thinking rather than conditioned responses.
Privilege escalation is the process by which an attacker or malicious software gains higher system access than was originally granted. It typically begins with a low-level foothold — a compromised standard user account or a phishing click — and works upward toward administrative permissions.
Every successful phish is a potential privilege escalation entry point. A repeat clicker who surrenders credentials, installs a malicious attachment or authorises an OAuth request hands an attacker the initial foothold that escalation requires. The human layer and the technical layer are not separate problems; the repeat clicker is frequently the door through which privilege escalation walks in.
Process mapping is one of the most practical tools available for tackling repeat clickers. It reveals exactly where they are most vulnerable — typically during high-volume, time-pressured workflows. By visualising these stress points, organisations can redesign processes around the people who struggle most, reduce cognitive load, prioritise tooling investments and target interventions far more precisely than blanket security awareness training ever could.
The confidence that admitting mistakes will not bring punishment is essential for reducing cyber risk. Employees who fear reprisal hide breaches rather than report them, allowing threats to spread undetected.
SecureClick creates a judgment-free space where employees feel safe to acknowledge mistakes, ask questions and develop genuine security awareness. The one important caveat: psychological safety is not the same as an absence of accountability. Research by Amy Edmondson is clear on this point — the goal is high safety and high standards together. The sweet spot is candour without blame, not candour without responsibility.
Many phishing victims have confided in us that the reason they didn't question a suspicious email or download with their IT teams was because of a fear of looking incompetent or "stupid." Remedial security training gives users the confidence and comfort to question anomalies — whether that be a suspicious email, link, text message or phone call.
Connecting security to something users genuinely care about requires moving the conversation away from organisational risk and toward personal relevance. For most users, the most powerful connection is personal — they already understand identity theft, compromised bank accounts and privacy violation in their own lives.
Training that begins there, showing how the same attacks that target them at home are deployed against them at work, closes the psychological distance between abstract corporate policy and lived experience. Role-based relevance matters equally — a finance professional who understands how Business Email Compromise leads directly to fraudulent transfers is far more engaged than one sitting through a generic phishing module.
Remote workers lack the informal cues that help flag suspicious requests in an office. Isolated and reliant on digital communication, they are prime targets for social engineering. SecureClick's remedial and high-risk training rebuilds that instinct, teaching users to verify identities, question urgency and think like a hacker.
Personal responsibility is crucial because phishing defences ultimately depend on individual judgment calls that no technology can fully automate. When people take ownership of their role as a defender, they shift from passive compliance to active vigilance, becoming more engaged in spotting subtle red flags and questioning unusual requests.
Role-based cyber security awareness training moves away from a one-size-fits-all approach and delivers content specifically tailored to an employee's function, responsibilities, and threat exposure. A finance director, a HR administrator, and a software developer face meaningfully different attack vectors and require different defensive behaviours.
LinkedIn has become a significant reconnaissance and targeting tool for attackers, who use publicly available role and seniority information to craft highly personalised spear phishing and vishing campaigns. Specific applications where role-based training adds measurable value include:
One of the only mainstream information security frameworks which discusses "repeat offenders" (repeat clickers). SANS identifies repeat phishing clickers as quantifiable risks, recommending targeted remedial training rather than blanket re-education.
Second-order deception is where an attacker anticipates what a security-aware target expects a threat to look like and deliberately engineers their approach to avoid those signals. Rather than sending an obviously suspicious email, they craft an interaction that feels reassuringly normal.
Generic security awareness training almost exclusively focuses on recognising first-order threats — poor grammar, urgent language, suspicious links. This creates a predictable and exploitable mental model. Ironically, a trained employee can become easier to deceive than an untrained one, because an attacker who knows the curriculum can simply design around it.
Security fatigue occurs when employees are so overwhelmed by the volume and frequency of security prompts, alerts, and procedures that they begin complying automatically rather than thoughtfully. Nowhere is this more dangerous than with MFA.
Attackers actively exploit fatigue through MFA prompt bombing — sending repeated push notification requests to a target until they approve one simply to make the notifications stop. An employee who understands what they are approving and why will pause before accepting an unexpected prompt. An employee conditioned by fatigue simply taps approve.
The path to robust behaviour change begins with recognition of the self. SecureClick's approach works by holding up a mirror: showing individuals precisely where and why they stumble with cyber risks. Rather than generic warnings, employees see their own click patterns, understand what makes them susceptible to phishing and recognise the consequences of inattention.
Imbuing employees with the insight of "this is how my brain responds to stressor events" can be a potent antidote to social engineering attacks.
Self-monitoring is the capacity to observe and evaluate one's own behaviour in real time. For repeat clickers, several practical habits support genuine self-monitoring:
Session hijacking is an attack where an adversary steals a valid session token issued after login and uses it to impersonate a user without needing their password or second factor. The two most common theft methods are infostealer malware and Adversary-in-the-Middle phishing proxies like Evilginx.
MFA does not help because it protects the login event, not the session itself. Security awareness training is one of the most impactful interventions available — because most of these attacks begin with a user clicking a phishing link, teaching people to scrutinise login pages and verify URLs carefully can break the attack chain before any token is stolen.
Scenario-based learning places employees in realistic, simulated situations where they must make decisions and respond to events as they would in real life. It is particularly effective against social engineering because these attacks exploit human behaviour rather than technical vulnerabilities.
Reading about phishing is passive, but working through a realistic scenario activates the same cognitive and emotional responses a real attack would trigger. This repeated exposure in a safe environment builds pattern recognition, so employees begin to notice the subtle cues that signal manipulation rather than just memorising a checklist of warning signs.
Single Sign-On (SSO) allows users to log in once and gain access to multiple connected applications. When a user authenticates through Entra ID (formerly Azure Active Directory), the platform issues a token that acts as a trusted passport across every connected application.
Steal that token, and an attacker inherits seamless access to the entire ecosystem — Microsoft 365 email, SharePoint, Salesforce CRM, Workday HR, and more — without ever needing a password. MFA offers no meaningful protection here. Because the token is issued after authentication is already complete, presenting it requires no password, no one-time code, and no biometric.
Spear-phishing is a highly personalised form of phishing in which attackers research their target using social media, LinkedIn, company websites or leaked data to craft messages that appear genuinely credible. Unlike bulk phishing, which casts a wide net, spear-phishing is precise, tailored and difficult to dismiss.
Targeted security awareness training for high-risk users helps by shifting users from content trust to process trust — teaching them to verify requests through independent channels regardless of how plausible they appear.
Daniel Kahneman's Systems 1 and 2 thinking model powerfully explains why phishing works. System 1 is fast, instinctive, and emotional — it reacts without engaging the logical part of the brain. Phishing is explicitly engineered to hijack it, using urgency, fear, and authority to trigger automatic responses before rational thought engages.
System 2 is slow, deliberate, and analytical — capable of spotting the deception, but easily bypassed when employees are busy, stressed, or distracted. Effective security training must activate System 2 at the moment System 1 is being exploited.
Targeted security awareness training delivers role-specific threat awareness to employees based on their risk exposure, ensuring those handling sensitive data or systems receive deeper, relevant instruction — reducing human error, strengthening defences and maximising training ROI. Targeted training fills the gaps and blind spots often not covered by generic security awareness training.
SecureClick's Think-like-a-Hacker approach teaches employees to see their organisation through a criminal's eyes — understanding how attackers identify, target and exploit human vulnerabilities before they strike.
When employees step into the attacker's mindset, the threat becomes human and immediate rather than abstract and theoretical. They understand the why behind every tactic — why attackers craft urgent emails, why they harvest LinkedIn profiles, why they target the rushed, the distracted, the helpful. That understanding is far stickier than any compliance module.
Eric Berne, the founder of Transactional Analysis, would likely view repeat clickers through the lens of ego states and psychological games. If security awareness training positions IT as the critical Parent lecturing a non-compliant Child, repeat clickers may be responding not to the threat but to the dynamic.
The intervention, in Berne's framework, would shift the security awareness education dynamic from Parent-Child to Adult-Adult — engaging the user as a rational, capable individual who can understand risk and make informed decisions, rather than someone being managed into compliance. That shift in relational tone, he would argue, is often more powerful than the content of the training itself.
Triggers are the psychological and environmental cues that prompt users to act without thinking — urgency, authority, scarcity, fear and social pressure. Attackers deliberately engineer them. A message warning that an account will be suspended, a caller claiming to be from IT demanding immediate action, an email appearing to come from a senior executive.
Once users can name what is happening — "this message is manufactured to make me feel urgent" — they become more resilient. Your remedial cyber security awareness training for high-risk users should expose them to realistic cyber threat scenarios using psychological triggers such as urgency, curiosity and deference to authority.
Kurt Lewin's Unfreeze-Change-Refreeze model identifies three stages that most security awareness programmes routinely mishandle:
Lewin held that behaviour is a function of the person and their environment together. Blaming the individual while leaving the field unchanged is both analytically wrong and practically useless.
Skipping secondary checks because they feel awkward or slow. Remedial security training builds the habit of out-of-band verification — making it feel natural rather than disruptive to confirm requests through a separate channel before acting on them.
A remote access VPN connection is particularly dangerous in the hands of a repeat clicker because it creates a direct and trusted tunnel into an organisation's internal network. For a repeat clicker who is already statistically more likely to engage with a malicious link or attachment, that heightened access dramatically amplifies the potential consequences of a single lapse in judgment.
Organisations can lower their risk:
Vishing (or voice phishing) is the use of phone calls or voice messages to manipulate victims into revealing sensitive information or taking harmful actions, typically by impersonating a trusted authority such as IT support, a bank or a government agency.
Voice conveys urgency, authority and emotion in ways that email cannot. Our social instinct to cooperate with our colleagues overrides our critical judgement, often instantly. Remedial training helps by breaking that automatic response — teaching users to slow down, verify caller identity through independent channels, and treat unsolicited calls requesting credentials or access as inherently suspicious.
A common piece of advice given to IT teams is to ask repeat clickers "why" they keep clicking. While this question might seem relatively benign on the surface, to the phishing victim, it can sound accusatory and encourage a defensive response.
A better alternative might be to ask a more neutral question such as "what were the factors that made you click?" This is much more likely to reveal the true underlying causes.
Many users believe that if they do inadvertently click on a malicious file or URL their extended detection and response (XDR) application — essentially sophisticated antivirus — will catch it. Unfortunately, this is not always the case.
Threat actors will use native Windows tools (such as PowerShell and PsExec) or obfuscation techniques to evade detection. Ultimately, the user is the last line of defence. Our remedial security awareness training shows your users the shortcomings of technical defences, making them less complacent.
A YubiKey is a physical hardware security key that provides one of the strongest forms of authentication currently available. Rather than relying on a code sent by SMS or generated by an authenticator app — both of which can be intercepted or bypassed — a YubiKey requires the user to physically insert the device and touch it to authenticate.
However, even this control has a human limit. Social engineering remains effective regardless of the authentication method in place. An attacker who convinces a user to authenticate on their behalf — through a fabricated IT support call, a fake urgent system alert, or a convincing internal request — can simply ask the user to insert their YubiKey and approve the session themselves. The strongest hardware token in the world cannot compensate for a user who has been manipulated into using it on an attacker's behalf.
Zero Trust is like having multiple locked doors and checkpoints throughout a building, while cybersecurity awareness is teaching people not to hold doors open for strangers or share their key cards.
The locks help when people make mistakes, but educated people make the whole system stronger. Zero Trust architecture assumes no user or device is inherently trusted — but it still depends on users who understand why those controls exist and don't inadvertently undermine them.