The challenge

Like most public sector bodies, Reigate & Banstead Borough Council faced a familiar problem: people were seeing suspicious emails but were inconsistent in their handling of them.

Some people deleted suspicious emails, while others clicked on them. In both cases, the security team had no visibility or opportunity to intervene. With a reporting rate of about 22% in 2025, most simulated phishing emails went unreported, leaving the council reliant on chance rather than an alert workforce.

Phishing simulations themselves had historically run as short, infrequent bursts — a couple of campaigns a year with limited reach — rather than an ongoing programme. Consequently, awareness would spike briefly and fade.

The deeper issue wasn't just the numbers. It was culture. Reporting a suspicious email felt like an isolated, slightly awkward act, not something people talked about with colleagues. Security awareness lived closer to an annual tick-box exercise than an everyday habit.

‍

Initial goals

Reigate & Banstead, led by Security Awareness Lead Sandra Hopwood, set out to:

‍

The solution and implementation

Reigate & Banstead built its programme around three CybSafe products: GUIDE and GUIDE+ for training and awareness content and PHISH for phishing simulation.

Working closely with the CybSafe team over more than a year, Sandra shifted the phishing programme from short, occasional bursts to continuous, spaced-out campaigns running throughout the year, using a growing library of templates (eventually 22 different templates in a single quarter) so staff faced varied, realistic scenarios rather than the same test twice.

A turning point was the "I'm a Phish" template, rolled out to shift the emphasis from "Did you click?" to "Did you report?" — deliberately training the muscle memory of flagging a suspicious email rather than punishing a click.

Alongside this, the council:

• Discussed setting up a mail flow rule so the service desk could more easily distinguish CybSafe's simulation emails from genuine threats, alongside directly educating the service desk on what CybSafe emails look like.
• Kept councillors and service desk staff in separate, tailored campaigns, with plans to introduce harder, unannounced simulations for the service desk given their frontline exposure.
• Rolled out mandatory training with real consequences, including possible network access restrictions for non-completion for higher-risk groups.
• Used executive sponsorship deliberately — a reminder email from the Chief Executive lifted training completion, and Sandra secured executive buy-in during a Q&A session on cybersecurity.
• Used behavioural nudges to prompt training completion, provide seasonal bite-sized advice and reinforce good habits between formal campaigns. The council also considered publicly recognising “security heroes” in the future.

‍

The results

The change showed up in both the numbers and how people behaved day to day.

Beyond the metrics, Sandra described a genuine shift in behaviour. As she put it:

"Before, those were silent conversations. Now people are approaching our service desk and saying, 'I've got this email, I haven't opened it.' Whereas before they'd either just delete it — or do the worst."

Staff stopped handling suspicious emails alone. And just as importantly, people started talking to each other about what they'd spotted, rather than treating it as a solitary, slightly awkward moment:

"If people are having the conversation, then my work here is done."

Sandra Hopwood

Security Awareness Lead, Reigate & Banstead Borough Council

‍

Final thoughts

Reigate & Banstead's experience shows what happens when a security awareness programme targets behaviour, not just knowledge, and pairs continuous phishing simulation with real executive sponsorship. By making reporting the natural response — and by giving people a reason to talk about what they see — the council more than doubled its report rate, lifted training completion by 25 points, and, more importantly, built a habit that should outlast any single campaign.