Social engineering campaigns

Not individually, or the measurement is worthless. But the campaign is never covert: it is authorised in writing by management, and its framing — general notice to staff, consultation of employee representatives where required — is decided with you before launch. What makes a campaign ethical is not the absence of surprise, it is the existence of a clear mandate and known rules.

No. We report collective indicators — open, click and credential-entry rates, broken down by population or entity — never a list of names handed to management. A social engineering campaign measures how well a system works, not one person's mistake. Treating it otherwise would make it counterproductive, and hard to defend under employment and data protection law.

Nothing punitive. A high click rate points to a flaw in the arrangements — reporting that is too cumbersome, no clear signals, a validation procedure that can be bypassed — rather than a flaw in people. The result is there to target awareness where it is missing and to fix what makes the lure credible. The indicator that matters in the end is not the click rate but the reporting rate: only that one shows the alert chain works.