Clear Path step · Business · A team that's hard to fool
Train on today's tricks and make reporting instant and blame-free
Why it matters: The lures change faster than annual training: QR codes, fake help-desk chats in Teams or Slack, 'verify you are human' pages that ask you to paste a command, cloned voices. Fast, unembarrassed reporting is what turns one person's click into a five-minute fix.
Left off your path if you picked “Just me” for “How many people work here, including you?”.
Do it
- Turn on a report-phishing button in email.
- Spend ten minutes a month on one current lure, using real examples.
- Teach three rules: never read out a sign-in code, never approve an MFA prompt you didn't start, never paste a command a website or 'IT' tells you to.
- Tell staff the real IT provider will never contact them first through an outside chat account.
- Thank people publicly for reports, including false alarms.
Check it worked: Staff get a short monthly briefing on current lures, can report a suspicious message in one click, and know that reporting a mistake fast is praised, not punished.
Simply put
It's like a fire alarm everyone is thanked for pulling, even for burnt toast. When reporting is instant and blame-free, one person's click becomes a quick fix instead of a quiet problem.
In detail
AI-written phishing removes the typos people were trained to spot, so training should teach the request, not the writing: money, codes, sign-ins and urgency. Measure report rates, not just click rates.
If this is new to you: Worried staff will feel tested or watched? Keep it to ten friendly minutes a month on one real example, and thank every report out loud, false alarms included.
Points toward the Long View: a team that spots the request for money, codes or urgency, however polished the writing.