Phishing is still the number one way attackers get into small and mid-sized organizations, and it works because it targets people rather than systems. The fix is partly technical and partly human. This article covers both: what to do right now if someone on your team just clicked something, and what a real phishing training program should look like if you want to stop the next one.
If an employee just clicked a phishing link: do this first
Speed matters more than blame. Make it safe for people to report fast.
- Disconnect, don't shut down. Take the device off Wi-Fi or unplug the network cable. Leave it powered on so your IT provider can investigate what ran.
- Change the password from a different device. If the person entered credentials, change that password immediately, then every account that shares it. Prioritize email, Microsoft 365 or Google Workspace, banking and payroll.
- Revoke active sessions and check MFA. Attackers who capture a password often also capture the session token. Your admin should sign the user out everywhere and review whether a new MFA method or device was added to the account.
- Look for mailbox rules and forwarding. The most common post-phishing move is a hidden inbox rule that forwards or deletes mail so the attacker can run an invoice fraud without the victim noticing.
- Tell your IT provider or MSP, even if nothing seems wrong. A managed security team can pull logs, check for lateral movement and confirm the endpoint is clean. If you have cyber insurance, check whether the policy requires notification within a set window.
- Warn the people who might get the follow-up. If the compromised account sent messages, contacts will receive convincing phishing from a real address. A quick heads-up prevents the second wave.
If you don't have anyone to call for step five, that is the gap to fix. CIRRUS provides phishing incident support to organizations across Maryland, DC and Northern Virginia, including same-day response for active compromises.
What phishing training actually is (and isn't)
Phishing training is not a one-hour annual video. Research and our own client data agree: a single session changes behavior for a few weeks, then click rates drift back. An effective security awareness program has four parts that run continuously:
- Simulated phishing campaigns. Realistic test emails sent to staff on a schedule (we recommend monthly), using the same lures attackers use: package deliveries, password resets, shared documents, HR notices, invoices and messages that appear to come from the boss.
- Short, frequent training. Five- to ten-minute modules, delivered automatically when someone clicks a simulation and on a quarterly rotation for everyone else. Topics rotate: credential phishing, business email compromise, QR-code phishing, text-message smishing, voice-based vishing, and AI-generated lures that no longer contain typos.
- A one-click way to report. A "report phishing" button in Outlook or Gmail that routes suspicious messages to your security team. The goal is to make reporting faster than deleting.
- Measurement and follow-up. Two metrics matter: the click rate (what percentage of staff fell for the simulation) and the report rate (what percentage flagged it). A mature program sees click rates under 5 percent and report rates above 50 percent. Leadership should see these numbers quarterly.
Why the training has to come with technical controls
No amount of training gets a click rate to zero. People are busy, and modern phishing is good. Training reduces the number of incidents; controls limit the damage from the ones that still happen:
- Multi-factor authentication on every account, preferably app-based or passkeys rather than text messages.
- Advanced email filtering that scans links at the time of click, analyzes attachments and flags lookalike domains and brand impersonation.
- SPF, DKIM and DMARC on your own domain so criminals can't easily send mail that looks like it came from you.
- Endpoint detection and response with 24/7 monitoring, so a malicious download gets isolated at 11 p.m. instead of discovered Monday morning.
- A payment-change rule that no bank detail or wire instruction is updated without a phone call to a number already on file. Most business email compromise losses in this region come down to this single missing step.
Who requires phishing training
Even if you'd never been attacked, there's a good chance someone requires you to do this:
- Cyber insurance carriers increasingly ask whether you run security awareness training and phishing simulations, and price the policy accordingly.
- HIPAA requires security awareness training for workforce members at covered entities and business associates.
- CMMC and NIST SP 800-171 for defense contractors include awareness and training controls (AT.L2-3.2.1 through 3.2.3).
- SOC 2 and ISO 27001 both expect documented, recurring awareness training with evidence of completion.
- Customer security questionnaires from larger clients, utilities and government agencies almost always include a question about it.
If you serve any of those audiences, the program also needs to produce evidence: completion records, campaign results and a policy that says how often training happens. A good provider generates that for you.
What it costs
Standalone security awareness platforms cost a few dollars per user per month. The bigger cost is the time to run campaigns, chase completions and report results, which is why most small organizations get it bundled into a managed IT or managed security agreement. CIRRUS includes phishing simulation and security awareness training in its managed IT services, with campaign results and completion reporting delivered to leadership quarterly, and we can run it as a standalone program for organizations that keep their own IT staff.
Frequently asked questions
How often should we run phishing simulations?
Monthly is the sweet spot. Quarterly lets habits fade; weekly breeds resentment. Vary the lure type and sender so people learn to recognize patterns rather than a specific template.
Should we punish employees who click?
No. Punishment drives reporting underground, which is the opposite of what you want. The right response to a click is a short training module and a conversation; the right response to a report is a thank-you. Track repeat clickers and give them extra coaching, not discipline.
What's the difference between phishing, spear phishing and business email compromise?
Phishing is mass-sent bait. Spear phishing is targeted at a specific person using details about them or their company. Business email compromise (BEC) is the fraud that follows a successful compromise: an attacker uses a real or lookalike account to redirect payments, change payroll details or request gift cards. BEC produces the largest losses by far.
Do you offer phishing training in Maryland, DC and Virginia?
Yes. CIRRUS delivers phishing simulation and security awareness training to small businesses, nonprofits, engineering and construction firms, schools, medical practices and government contractors across the DMV, either bundled with managed IT or as a standalone program. Contact us to set up a baseline campaign; the first results usually arrive within two weeks.
