Security Awareness: How to properly address colleagues who repeatedly fail Phishing tests?

Good Morning,


With regards to shifting security culture, I try to be hands off and let phishing tests be one of many indicators of the efficacy of security culture implementation. While our stats are very much improved organizationally (\~5000 employees), I have a group of about \~600 employees who fail far too often. Let me caveat that with, when looking at who fails, it is almost by rule folks with very limited privilege/access. From an organizational risk perspective, I am …

address awareness culture cybersecurity employees fail phishing security security awareness security culture tests