Building a Measurable Security Awareness Program for a Healthcare Organisation

The client

An Australian healthcare organisation whose people work with sensitive patient, operational and corporate information every day. Email is central to how the organisation works, making it an obvious route for phishing attacks.

The organisation wanted to move away from treating security awareness as a once-a-year exercise and build something that stayed relevant throughout the year.

The challenge

The organisation already understood the limits of annual awareness training. Completing a course does not necessarily mean someone will recognise a convincing phishing email months later. This was particularly important in healthcare, where staff receive a constant flow of internal notifications, shared documents, invoices, and account prompts that an attacker can convincingly imitate.

The organisation needed a structured program that could:

• Keep security awareness active throughout the year.
• Regularly test whether employees could recognise phishing attempts.
• Reinforce training when an employee was successfully phished.
• Give employees a simple way to report suspicious messages.
• Measure participation and behaviour over time.
• Provide management with meaningful reporting rather than raw platform statistics.

Just as importantly, the internal team didn't want another platform they had to run themselves. They wanted the program managed for them, with clear visibility of what was happening and where attention was needed.

The approach

CypherLeap took on the day-to-day running of the program. We schedule security awareness training every month, run a phishing simulation each quarter, retrain users who are caught by a simulation and provide management with a monthly view of how the program is tracking.

Train → Test → Identify → Retrain → Measure → Improve.

Training and phishing testing are deliberately linked. If someone falls for a simulated phishing email, they go back through the relevant training. The next campaigns then give the organisation a practical way to see whether behaviour is changing.

Monthly security awareness training

CypherLeap schedules and manages security awareness training every month. This keeps security front of mind without leaving the customer's internal team to organise campaigns, enrol users and keep the program moving.

We track who has completed the training and where follow-up is needed. Training adherence is then included in the monthly management report.

Quarterly phishing simulations

Every quarter, CypherLeap runs a controlled phishing simulation across the organisation. The aim is not to catch people out with tricks. It gives staff a realistic opportunity to practise spotting the kinds of emails that could appear in their inbox on an ordinary working day.

Running the exercises consistently also gives the organisation something useful to measure. Click rates, reporting behaviour and changes from one campaign to the next can be reviewed over time instead of looking at a single test in isolation.

Turning a failed simulation into training

When someone clicks a simulated phishing email, the result becomes a learning opportunity rather than simply a recorded failure. That user is required to complete the relevant awareness training again.

This keeps the response simple: the behaviour that created the risk leads directly to additional training. Future phishing exercises then show whether the lesson has stuck.

Making employees part of the defence

Employees can also report suspicious emails using a phishing-reporting icon built into their mailbox. They do not need to forward the message, open a ticket or work out who in IT to contact.

Don’t just avoid the click. Recognise it. Report it.

That makes reporting suspicious email part of the everyday behaviour the program is trying to build. It also gives management another useful measure alongside click rates and training completion.

Giving management visibility of human risk

Each month, CypherLeap gives management a clear report on how the program is performing. It brings key measures together in one place so the organisation can see what's improving and where it needs more attention.

• Training adherence. Participation and completion of assigned security awareness training.
• Phishing click rate. The proportion of employees interacting with simulated phishing campaigns.
• Reporting behaviour. How employees use the mailbox reporting capability to identify suspicious emails.
• Repeat behaviour. Users or groups requiring further awareness or remediation.
• Trends over time. Changes in training participation and phishing behaviour across successive reporting periods.

The outcome

The result is a security awareness program that runs year-round rather than appearing once at compliance time. Staff receive regular training, phishing behaviour is tested every quarter, people who are caught are retrained, and employees have an easy way to report suspicious email.

Management gets a monthly view of training adherence, phishing click rates and trends, while the internal team is not left carrying the administration needed to keep the program running.

Security awareness is no longer just a training requirement to complete. It is an ongoing program the organisation can see, measure and improve.

From awareness training to measurable human risk.

By bringing training, phishing tests, retraining, employee reporting and management reporting together, CypherLeap gave the organisation a practical way to keep improving how its people respond to phishing. Train. Test. Report. Remediate. Measure. Repeat.