Click-rate is a vanity metric — measure reporting instead
Why click-through on phishing simulations is the weakest signal you can track, and what to measure instead.
Field notes
Writing on our work
Observations from current engagements, opinion on industry developments, and the occasional longer essay.
Adversary-in-the-middle phishing — what changed in 2025
Token-stealing phishing kits are now commodity. What that means for your detection layer and how training has to adapt.
Quishing as the new default vector
QR-code phishing has moved from edge case to dominant initial vector in many engagements. The implications run beyond email security.
Awareness training that survives the second year
Most awareness programmes peak in year one and decline thereafter. Three structural changes that change the trajectory.
Tabletop exercises that actually rehearse the hard parts
Most tabletops rehearse the technical investigation. The communications and decision flow — the hard parts — usually go unpracticed.
What to tell the board about phishing-resilience
Board-level communication about awareness programme outcomes works when it is short, narrative-driven, and explicit about what to ignore.