Get Phishing Under Control

From a 60% click rate to under 5% - and how to do it in six months.

Your shelves are already full of books telling you to train your users, deploy technical controls, and measure click rates. This one is different, because it starts from an uncomfortable admission: most phishing awareness programmes stall somewhere above a 10% click rate and never recover. Not because the people running them are careless, but
because they are fighting on one front when the problem has two. Phishing is a technical problem that awareness campaigns cannot fix, and a human problem that technology alone cannot solve. Written by a security consultant with more than three decades in IT, psychology and information security, this is the practical, end-to-end handbook for people who actually have to run the programme.

You get a seven-phase path, from a scored diagnostic that tells you where to start, through email authentication and detection aids, into exercises, behaviour change, honest measurement, and governance. Every action is tagged MUST, SHOULD, or ADVANCED, so a team with one afternoon and no budget knows exactly what to do first - and a mature programme knows where to go next.

Inside:

• A quick-start minimum you can deploy this week: SPF, DKIM, DMARC, an external-sender banner, and a report button.
• Why frequency beats sophistication - and why an exercise every three weeks does more than one brilliant campaign a year.
• The cognitive science that explains why awareness training fails: dual-process theory, habits versus heuristics, nudges, and the reason telling people what not to do backfires.
• Metrics you can defend: the Siadati parallel model, confidence intervals, false positives, and the vanity numbers to stop reporting.
• The ethics and governance most programmes treat as an afterthought - advisory boards, data handling, works councils, and why sanctioning people destroys the reporting rate that actually protects you.
• Ready-to-adapt annexes: a platform selection matrix, staff and works council communications, a code of ethics, a data handling notice, and advisory board terms of reference.