Tools
Security awareness training: what actually reduces clicks
Annual video training does not change behaviour. What does, and why punishing people who click makes your next incident worse.
Microsoft
The annual module is a compliance artefact
A once-yearly training video produces a completion record. That record satisfies an auditor and has very little relationship to whether anyone behaves differently in March.
This is worth saying plainly because the budget usually goes to the thing that produces the record, and the thing that changes behaviour is cheaper.
What actually moves the number
Short, frequent, and specific to your organisation
Three minutes about a lure that references your actual payroll provider beats forty minutes of generic content. Attack simulation training in Defender for Office P2 does this and many organisations already own it.
Make reporting easy and visibly valued
A report button in Outlook, and a genuine thank you when somebody uses it. The goal is a workforce that reports, not one that never clicks, because somebody will always eventually click.
Never punish the click
The moment clicking has consequences, people stop reporting. You have then traded a measurable click rate for an invisible one, which is strictly worse.
Measure reporting rate, not just click rate
Click rate falling while reporting rate also falls is a bad outcome disguised as a good one. It usually means people have learned to say nothing.
The verdict
Attack simulation training, if you already hold Defender for Office P2
You own it, it targets your own users with your own context, and it reports on both click and report rates.
Skip any programme built around naming individuals or mandatory remedial training after a click. It reliably reduces reporting, which is the metric that actually protects you.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.