Frequently Asked Questions

There are several reasons why generic cyber security awareness training such as KnowBe4, ProofPoint and Metacompliance don't work for repeat offenders.

1. It doesn't address the root cause — Users like repeat clickers already know phishing is bad and what to look for. Making them sit through the same content again doesn't address why they clicked despite knowing better.
2. It treats a behavioural problem like an information problem — Most generic training assumes mistakes happen due to lack of knowledge. In reality, breaches stem from ingrained habits and cognitive shortcuts that e-learning can't rewire. Our targeted instructor-led intervention works differently. An instructor, certified in human risk management, identifies an individual's or team's specific behavioural patterns and uses live scenarios and direct feedback to change how people actually respond under pressure. A quiz score can't do that.
3. Compliance metrics mask real risk — Completion rates and pass scores give leadership a false sense of security. An employee can score 100% on a phishing awareness test and still fall for a well-crafted spear-phishing email weeks later. When training is measured by whether people sat through it, rather than whether they behave differently, organisations are essentially auditing their own blind spot and calling it due diligence.
4. Individual triggers aren't addressed — Maybe this person specifically falls for "urgent invoice" emails because they're in finance and trained to process invoices quickly. Maybe they're neurodiverse. Generic training won't rewire that specific automatic response pattern.
5. It's passive, not active practice — Lasting behaviour change requires practice in realistic conditions. Just consuming information again doesn't build new neural pathways or muscle memory. Our human-led sessions place users in realistic, challenging scenarios that demand active thinking — developing the kind of security instincts that classroom training and e-learning simply can't build.

What works instead:

• Personalised simulation based on what they actually fell for — such as an email from a threat actor impersonating a supplier or a bogus Microsoft 365 password reset link.
• Immediate micro-coaching shortly after they click a test phish (while the emotion is fresh).
• Environmental redesign — tools that nudge a pause before clicking or divulging information.
• Habit substitution — building a specific "check before click" routine.
• Peer accountability or buddy systems.

Auditors aren't trying to catch anyone out. They want to understand whether your organisation is actively managing risk and following its own processes. When it comes to repeat offenders, they typically want to see a few key things:

• Clear definitions: There should be a consistent, documented threshold for what counts as a repeat failure.
• Graduated responses: Remedial steps are taken that increase in intensity with each failure — from retraining, to coaching, to formal escalation — and these steps are applied fairly.
• Management oversight: Supervisors, HR, and leadership are aware of remedial actions and take responsibility for ensuring the process works.
• Evidence of action: Metrics are tracked, corrective actions are recorded and outcomes are measurable.
• Consistency: Auditors will want to see that all employees, including contractors or privileged users where appropriate, are treated under the same rules.
• Focus on improvement: The emphasis should be on reducing risk and reinforcing training, not punishing people.

In short, auditors want to see that repeat offenders are noticed, addressed, tracked and that your organisation can show that its approach actually reduces risk over time.

By targeting the specific behaviours or knowledge areas that led to failure, it demonstrates a thoughtful, graduated response. Each of our repeat clicker coaching sessions is documented, allowing auditors to verify both participation and content. Follow-up metrics, such as improved phishing simulation scores or improved incident reporting rates, show that the interventions actually work. SecureClick's remedial training turns isolated failures into measurable improvements, satisfying regulators and reinforcing a culture of accountability.

When an employee falls for a phishing attack, punishment is seldom the answer. A lapse here or there does not merit dismissal or even a stern telling-off. Phishing ought to be treated much like a slip on a wet floor: as a sign that the workplace needs fixing, not that the worker is incompetent. Those who open risky emails are often let down by poor training, unclear rules or inadequate defences. Leaping to discipline risks discouraging people from owning up to their mistakes, making the organisation less secure, not more.

Yet serial offenders cannot be indulged forever. Once an employee has received tailored training, personal coaching and honest feedback — and once the firm has put sensible safeguards in place — persistent clicking can become a liability. What began as an honest mistake evolves into a failure to follow established protocol. At that point, discipline is not only defensible but necessary, so long as it is transparent, consistent and grounded in policy that has been clearly explained.

The right approach is both graduated and documented. Start with formal warnings tied to company rules, set a deadline for improvement and spell out what happens if things do not change. Only in the gravest cases — after training has been offered, technical guardrails applied and fair warning given — should reassignment or dismissal be on the table. This measured escalation protects your organisation without tipping into vindictiveness, aligning individual accountability with broader risk-management goals.

The guiding principle is simple: phishing failures are learning opportunities until they become a pattern of recklessness. Handled this way, firms can strike a balance between security, staff development and fairness — a balance that, when got right, bolsters both defences and actually enhances the security culture of your organisation.

Disciplining employees for repeated phishing failures requires judgment, not reflex. A single lapse, or even several, rarely warrants punishment. Organisations do better to treat phishing vulnerabilities as they would any workplace safety hazard: a prompt to educate, not castigate. Employees who click malicious links are often let down by patchy training, unclear expectations or inadequate defences. Jumping straight to discipline can often be perceived as arbitrary — and worse, it may discourage people from admitting mistakes, which only compounds the security risk.

Persistent failures are another matter. Once an organisation has offered targeted support — proper training, one-to-one coaching, honest feedback — and put sensible safeguards in place, repeated unsafe behaviour becomes a liability. What started as an honest slip turns into refusal to follow basic protocols. At that point, discipline is not only defensible but necessary, so long as it is transparent, consistent and grounded in clearly explained policies.

The right approach is measured and documented. Begin with formal warnings tied to company rules, set deadlines for improvement and spell out what happens if behaviour does not change. Only in the most serious cases — after training, technical fixes and fair warnings — should reassignment or dismissal enter the conversation.

The principle is simple: treat phishing failures as teachable moments until they reveal a pattern of carelessness or deliberate neglect. Remedial training, when properly tailored to individual weaknesses, transforms the equation entirely. An employee who once clicked indiscriminately learns to spot warning signs, pause before acting and report suspicious messages as a matter of course. Over time, what began as vulnerability becomes vigilance. The workforce grows alert without becoming fearful, security incidents decline, and cyber hygiene shifts from corporate mandate to ingrained habit. That is when defences are not merely adequate but genuinely resilient.

1. Make it personal, not punitive — People get defensive when they feel stupid. Frame it as "these attacks are designed by experts to exploit how our brains work" rather than "you keep making mistakes."
2. Identify their specific pattern — Do they fall for authority figures (CEO emails)? Urgency? Curiosity (package deliveries)? The remediation needs to target their specific vulnerability, not generic awareness.
3. Build a "pre-click pause" habit — Create a tiny habit: "Before I click any link, I hover over it and check the actual URL." Make it so small it's hard to refuse.
4. Use real-life phishing examples they fell for — Walk through the specific phishing emails they clicked on. What caught their attention? What would they look for now? Make it concrete and personal.
5. Create environmental cues — Physical reminders at their workspace such as printed job-aids, email banners on external emails. Make the safe behaviour easier than the risky one.