Platforms range from annual video courses to continuous, adaptive simulations. Compare how realistic the simulations are, whether reporting is rewarded, and whether reported emails feed back into your security team's workflow.
Why it works
Underwriters routinely ask about training because people are the target of most initial access. Regular simulations measurably raise reporting rates and lower click rates.
What to look for
Frequent, short simulations work better than a once-a-year course.
Employees should be able to report a suspicious email with one click, and those reports should reach your security team.
Reporting should show repeat clickers and how people improve over time.