Teach by role and moment
Developers, finance teams, executives and support staff face different decisions. Use short scenarios tied to the tools and approvals they use.
Make reporting easy
Provide one memorable route for suspicious messages and events. Acknowledge reports quickly and tell people what happened when it is safe to do so.
Reinforce safe defaults
Pair learning with MFA, password managers, email controls, device management and clear payment or data-sharing approvals. Training cannot compensate for hostile workflow design.
Use humane measures
Track reporting speed, repeat exposure, time to support a reporter and control improvements. Avoid public ranking and punishment that suppress future reporting.
Measure the system tooA clicked simulation can reveal confusing processes, unsafe defaults or a reporting path that is harder than the attacker path.