Awareness Campaigns, Simulations and Measuring Human Risk

Awareness is a campaign, not an event

A single annual session is easy to forget. People change habits through small, repeated nudges that connect to real work. An awareness campaign is a planned series of messages and activities aimed at one behaviour, such as 'verify any change in bank details by phone' or 'report suspicious messages using the agreed route'. Short, regular and relevant beats long, rare and generic.

Plan a campaign in six steps

1. 1Pick one behaviour you want to see more often, linked to a real risk in your business.
2. 2Define the audience: the whole team, or a group such as accounts, sales or the front desk.
3. 3Choose formats that fit how people work: a five-minute team huddle, a poster near the billing desk, a short WhatsApp tip from the owner, or a HUMANWALL mission.
4. 4Set a time frame, for example four weeks, with one message each week.
5. 5Decide what you will measure before you start, and how you will collect it without exposing personal or sensitive data.
6. 6Plan follow-up: what will you fix or repeat based on what you learn?

Simulations: useful, but only when done ethically

A simulation is a safe practice exercise, such as a harmless test email that looks suspicious, to see whether people notice and report it. Done well, simulations build confidence and show where processes need help. Done badly, they damage trust and make people afraid of their inbox. The purpose of a simulation is to safely measure and improve a defined behaviour. It is never to catch people out.

Ethical safeguards before any simulation

• Get written approval from the owner or management, and involve HR or whoever handles staff matters.
• Define the objective and scope: which behaviour, which team, which time window.
• Use only synthetic content and harmless landing pages. Never build anything that collects real passwords, OTPs or personal data.
• Avoid themes that cause real distress, such as fake salary cuts, medical news, bonuses that do not exist or family emergencies.
• Tell staff in general terms that practice exercises happen from time to time, so they are part of the culture, not a trap.
• Plan support: a short, kind learning message for anyone who clicks, and thanks for everyone who reports.
• If you use an external provider, agree in writing what data they collect, how it is protected and when it is deleted.

Measure what actually reduces risk

Click rate alone is a weak measure. It depends heavily on how hard the test was, and it rewards silence. Better measures look at what people do next. How many people reported the message? How quickly did the first report arrive? Did reporting improve from one exercise to the next? Did a process gap get fixed? Combine this with knowledge check results, near-miss reports and how often staff ask before acting. Interpret results in context: a rise in reports after a campaign is good news, even if a few people still clicked.