Why most programs fail before they start
The goal of a phishing awareness program is behavior change. Not knowledge transfer, almost everyone already knows phishing exists. Not compliance documentation, a signed acknowledgment form does not make anyone more likely to pause before clicking a suspicious link. The goal is to build a reflex: when something feels wrong, stop and verify before acting.
Reflexes are built through repetition. A once-a-year training module does not build a reflex. It builds the ability to pass a quiz, which is a completely different skill. If your current program consists of a video and a test, you have a compliance program, not a security program. Those are worth distinguishing before you decide what to build next.
The good news is that the research on what actually works is pretty clear, and it does not require a big budget. It requires frequency, realism, and a response to failure that teaches rather than punishes. AI makes all three of those meaningfully easier to deliver.
The four components of a program that actually changes behavior
1. Regular simulated phishing campaigns
Sending fake phishing emails to your own employees, tracking who clicks, and using the results to inform training is the single most effective intervention in the security awareness toolkit. It is not controversial among security professionals. The controversy, when it exists, is about how to do it in a way that builds awareness rather than just catching people and embarrassing them.
The frequency that works: monthly, or at minimum quarterly. Annual simulations give employees no meaningful practice. Monthly simulations, varied in style, sender type, and pretext, build the pattern-recognition reflex that translates to real threat detection.
The realism that works: emails that look like they could plausibly have come from inside your organization or from vendors and services your employees actually use. A generic “Your account has been compromised” template from a fictional bank is easy to spot. A message that appears to come from your HR system asking employees to update their direct deposit information is not. The closer to real, the more useful the test.
2. Immediate, non-punitive feedback at the moment of failure
When an employee clicks a simulated phishing link, what happens next determines whether your program builds awareness or builds resentment. The worst version: a stern email from IT, a note in their file, a mandatory remediation module that takes forty-five minutes and treats them like a child. That approach produces employees who hide mistakes, not employees who learn from them.
The version that works: an immediate, in-the-moment landing page that explains what just happened, shows them the specific signals they missed in that email, and gives them one or two things to remember next time. Two minutes. Specific. No shame. The learning happens while the experience is fresh, which is when it sticks.
The framing matters too. “You failed” is a closed loop. “Here is what this one was designed to make you do, and here is how to spot the next one” is an open loop that keeps people engaged rather than defensive.
3. Role-specific content, not generic content
A phishing attack targeting your finance team looks different from one targeting your customer service team, which looks different from one targeting your executive assistants. Generic training treats everyone the same. Effective training matches the threats each role actually faces.
Finance employees are targeted with fake wire transfer requests, vendor payment changes, and W-2 fraud. Customer service employees are targeted with fake customer account resets and credential harvesting. Executives and their assistants are targeted with BEC, business email compromise, attacks that impersonate known contacts and create urgency around financial or sensitive decisions.
A program that accounts for these differences will produce better outcomes than one that does not. It also signals to employees that someone has thought carefully about their specific risks, which increases engagement on its own.
4. A clear, blame-free reporting path
Employees who think they have clicked something real need to know exactly what to do and believe, genuinely, that reporting promptly will not result in punishment. This is not just a policy question, it is a cultural one. If the last person who reported a mistake got called out in front of their team, everyone in the organization learned from that. They learned to hide it next time.
The mechanics are simple: one email address or button to report a suspicious message, a committed response time from whoever monitors it, and a clear statement that early reporting is valued and not held against anyone. The culture is harder, but it starts with that statement being visibly true.
Where AI comes in
A program with those four components used to require either a vendor contract (expensive) or a lot of manual work from someone with security expertise (rare and also expensive). AI has changed the economics of both the content creation and the analysis sides of this work.
Creating realistic simulation templates
Writing convincing phishing simulation emails from scratch is harder than it sounds. They need to be realistic enough to be a genuine test without being so sophisticated that no reasonable person would catch them. They need variety: different pretexts, senders, urgency levels, and techniques. And they need to be refreshed regularly so employees are not seeing the same templates on repeat.
AI is genuinely good at this. Give it your organization’s context: your industry, the tools your employees use, the types of requests that flow through your business, and ask it to generate a batch of simulation templates at varying difficulty levels. You will need to review and adjust them for accuracy and appropriateness, but the drafting work that used to take hours takes minutes. Here is an example of the kind of prompt that works:
We are a 200-person distribution company. Our employees use
Microsoft 365, and our HR system is called Workday. Our finance
team regularly processes vendor invoices.
Write three phishing simulation email templates at different
difficulty levels:
- Easy: obvious red flags, generic sender, poor pretext
- Medium: plausible sender, reasonable pretext, one or two
subtle signals that something is off
- Hard: convincing sender display name, urgent but believable
pretext, closely mimics a real internal process
For each template, include a brief note on what signals
an alert employee should have caught.The output will not be perfect, but it will be a solid working draft you can refine with your own knowledge of your environment. That is the prompt-as-first-draft approach from last month’s post, applied directly to security work.
Writing the post-click feedback pages
The landing page an employee sees after clicking a simulated phishing link is one of the highest-leverage pieces of content in the entire program. It needs to be calm, specific, instructive, and brief. AI can draft these for each template you create, tailored to the specific signals in that email, in a fraction of the time it would take to write them from scratch.
Analyzing campaign results and identifying patterns
After each simulation, you have data: who clicked, what department they are in, which template caught the most people, how results compare to previous campaigns. Making sense of that data, identifying the teams that need more targeted training, spotting whether certain pretexts are consistently more effective, tracking whether the program is producing measurable improvement over time is exactly the kind of pattern recognition and summarization work AI handles well.
Export your results to a spreadsheet, paste the summary into Claude or ChatGPT, and ask it to identify the three most significant findings and suggest what the next campaign should focus on. You are not outsourcing the decision. You are getting a faster first read on data that would otherwise take an hour to work through manually.
Drafting manager notifications
One of the more delicate parts of running a phishing program is communicating results to managers, especially when someone on their team has failed repeatedly. The message needs to be factual, constructive, and framed in a way that positions the manager as a partner in improving their team’s security posture rather than a recipient of a performance complaint. AI drafts these well when given the right context, and getting the tone right on a sensitive communication is exactly the use case from post two of this series.
Tools worth knowing about
A few options at different price points, so you can choose based on where your organization is starting from.
If your budget is genuinely zero: GoPhish is a free, open-source phishing simulation platform that you can self-host. It requires some technical setup, but it is capable and free, and the AI tools described above do the content work alongside it. Not the easiest starting point, but entirely workable if someone on your team is comfortable with basic server administration.
If you have a modest budget: KnowBe4, Proofpoint Security Awareness, and Cofense all offer platforms that include simulation campaigns, training content libraries, and reporting at price points that scale with organization size. These handle the infrastructure so you can focus on the content and the culture. AI supplements them rather than replacing them, you use it to customize templates, draft communications, and make sense of your data.
If you are in Microsoft 365: Attack Simulator, included in certain Microsoft 365 licensing tiers, provides basic phishing simulation capability within the tenant you already have. It is not the most full-featured option, but it is there and it is paid for. If you have not looked at what your existing Microsoft licensing already includes, that is worth ten minutes of investigation before you buy a separate platform.
The one thing that determines whether your program sticks
All the technology and content in the world will not save a program that leadership does not visibly support. If executives are exempted from simulations, employees notice. If someone fails a simulation and the response from management is punitive, people talk. If there is never any acknowledgment that the program exists or that it is producing results, engagement decays.
The most effective programs I have seen have one thing in common: a senior leader who talks about security as a shared responsibility, not a compliance requirement, and who is visibly subject to the same rules as everyone else. That cultural signal is not something AI can produce. It has to come from a person. Everything else can be built around it.
A phishing awareness program does not need to be perfect to be valuable. It needs to be consistent, realistic, and kind when people fail. Those three things, maintained over twelve months, will produce a measurably more resilient team than any single training event ever will.
What is coming in April
Next month we shift gears: AI for the non-technical leader. If you manage people, run a business, or make decisions but you have no interest in the technical side of any of this - that post is written specifically for you. No code, no jargon, just a practical look at where AI makes the leadership and management parts of your work easier.
This is post seven of a two-year series on AI for real people doing real work. Post one covers what AI actually is. Post two is how I use these tools day to day. Post three covers the five free tools worth trying first. Post four is about taming email with AI. Post five covers the AI and security landscape right now. Post six is prompt engineering without the jargon. Questions about building or improving your phishing program? Send a note this is the work I do every day.
