Security awareness
Spear Phishing: Training People Without Blaming Them
In three lines
- Targeted phishing works because it is plausible, timely and specific.
- The metric that predicts outcomes is not click rate — it is how quickly the first person reports a campaign.
- Assume someone will click.
Targeted phishing works because it is plausible, timely and specific. The attacker knows your organisational chart, your suppliers and your invoicing cycle — often from public sources. No amount of scepticism training makes a convincing message look obviously fake.
Design the programme around reporting
The metric that predicts outcomes is not click rate — it is how quickly the first person reports a campaign. A report within four minutes lets you pull the message from every other inbox before it is opened. A culture that punishes clicks delays that first report by hours.
- One-click reporting inside the mail client
- Thank every reporter, including false alarms
- Publish what happened after each campaign
- Never name individuals in reporting to management
Controls that make the click survivable
Assume someone will click. Phishing-resistant multi-factor authentication, conditional access based on device state, blocking legacy authentication protocols and restricting who can approve a payment change all reduce a successful phish to a logged event rather than an incident.
Simulate realistically, but fairly
Simulations should reflect real campaigns your sector receives, be sent at a normal frequency rather than constantly, and avoid cruel pretexts such as fake bonus or termination notices. The purpose is to build a reflex, not to prove that people can be tricked.
The practical takeaway
Measure time-to-report instead of click rate, thank everyone who reports, and deploy controls that make a single click a non-event.
Related RASED services
Official references
Written by Khalid Namra
Founder & CEO, RASED Solutions — engineering lead of RASED Solutions
Khalid Namra building software since 2015 and leads the engineering and security teams behind RASED Solutions in Riyadh.
Related articles
Web development
SEO Services Prices in Saudi Arabia 2026: Real Costs, Packages and What You Pay For
Indicative market ranges for SEO in Saudi Arabia, what changes the price, what a serious proposal contains, and the questions to ask before you sign.
Web development
What Is SEO and How Does It Work? A Practical Guide for Saudi Businesses
What SEO actually is, how Google decides who appears first, and the three pillars every Saudi business website is judged on.
Web development
Local SEO and Google Maps in Saudi Arabia: How Nearby Customers Find You
How the local results box works, what your Google Business Profile must contain, and why your name, address and phone number must match everywhere.