The Person Who Clicked the Link Is Not Your Problem

The Person Who Clicked the Link Is Not Your Problem – Picture the moment. Someone in your office opens an email that looks like a shared invoice, clicks the link, types in their password, and then feels that cold drop in the stomach as the page does nothing useful. They know. What happens next in your company is the single most important security decision you will make that day, and it is made by a nervous employee deciding whether to tell anyone.

If your culture punishes that person, they will stay quiet, hope it was nothing, and quietly change their password a day later. If your culture rewards them, they will walk over to someone’s desk in ninety seconds. Sit through a few sales calls with cyber security companies in Calgary, or with firms anywhere in the US, and most of the pitch is about tools. Very little of it is about that ninety-second walk, which is where incidents are usually won or lost.

The phishing test that backfires

A lot of companies run simulated phishing campaigns, which is reasonable. Some then turn the results into a kind of public shaming. The people who clicked get named in a meeting, enrolled in remedial training with a faintly disciplinary tone, or teased about it for weeks. Management calls this accountability.

What it actually teaches is simple: clicking is bad, but getting caught clicking is worse. And unlike the simulated test, a real phishing email does not announce itself afterward. The only way anyone finds out is if the person who clicked decides to say so. You have just given them a strong reason not to.

I find this genuinely strange. We would never train fire safety by yelling at whoever pulled the alarm.

Everyone clicks eventually

Phishing is a numbers game, and the attacker gets unlimited tries. A good lure arrives at the wrong moment: the end of a long day, a week of real invoices, a message that appears to come from the boss. Smart, careful people click. Security professionals click. The goal of training cannot be a workforce that never makes a mistake, because that workforce does not exist.

The realistic goal is a workforce that reports mistakes fast. Speed is everything here. A stolen password reported in five minutes can usually be reset before anyone uses it. The same password discovered three weeks later, after the attacker has read the mailbox and set up forwarding rules, is a much longer and more expensive story.

What a reporting culture looks like in practice

The difference is not a policy document. It shows up in small, visible behaviours:

That last row is the whole point. The left column does not reduce mistakes. It only delays the moment you learn about them.

The leader goes first

The single most effective thing I have seen is a manager admitting their own near miss. “I almost entered my login on a fake page this morning, here is what it looked like.” It costs nothing, takes thirty seconds, and tells everyone in the room that reporting is normal. Compare that with an annual compliance video nobody remembers.

It also helps to make reporting absurdly easy. One button in the email client, or one number to call, with a human on the other end who says “thanks, good catch” before asking any questions. Then actually respond. If someone reports a suspicious email and hears nothing for a week, they will not bother next time.

Technology still matters, of course. Strong multi-factor authentication, sensible email filtering, and someone who can lock an account quickly all reduce the damage one click can do. But every one of those controls works better when the person who clicked speaks up immediately.

A question for Monday

Ask your team, honestly and without consequences, what they would do if they clicked a bad link right now. Who would they tell? Would they feel embarrassed? Would they worry about their job? Whatever they answer is a more accurate picture of your security than any dashboard, and it is something you can start fixing in the next staff meeting.