Zero to 345 in one campaign
over 4 weeks1 reporting
simulation
The problem: a reporting gap, not a susceptibility gap
These 3,115 people were not careless. They simply never told anyone.
PHISH counts first reports per person, so the security team can name these 345 rather than infer them from an average.
What they did
- Used PHISH to identify every person with no recorded phishing report
- Split them into an intervention arm of 2,807 and a control arm of 308
- Sent the intervention arm three nudges over four weeks, through Teams and email
- Ran one reporting simulation to the whole cohort
The result
345 people who had never reported a phishing simulation have now done it once.
That is approximately 11% of the cohort, every one of them from a lifetime record of zero, and every one of them named in PHISH.
Source: CybSafe PHISH, August 2026 Phishing Simulation, customer anonymised. Cohort: 3,115 people with no previously recorded phishing report. First-time reporter = a person with no prior recorded report who reported this simulation.
345
first-time reporters in one campaign
0
reports from these 3,115 people, ever, before the campaign
~11%
of the cohort reported for the first time
3
nudges over four weeks, through Teams and email
1
reporting simulation to the whole cohort
.avif)
