If the same person keeps clicking simulated phishing emails, then what do we do?

Start

One person has clicked practice emails more than once

Someone who keeps clicking needs help, a better-protected account or a lighter inbox. Support comes before any sanction, and a practice-email result is never on its own a ground for discipline. No exception can set that rule aside.

• Then: Keep it private: only the person and the awareness lead see names

Step

Keep it private: only the person and the awareness lead see names

Results by name go only to the person and the awareness lead. A line manager sees a name only at the third stage, with the person told first; HR sees one only to arrange an adjustment the person agrees to. Never name a repeat clicker to colleagues, in a league table or in any report above the person. Report repeat clickers only as a group share.

• Then: Could a mail scanner, not the person, have made the click?

Decision

Could a mail scanner, not the person, have made the click?

Mail security tools open links to scan them, and a platform can count those as clicks no person made. The platform should discard clicks made in the first seconds after delivery or from known scanner addresses. If you cannot tell, check before counting the click.

• Yes, or not known: Check the platform's records, and count only a person's clicks
• No: How many times has the person clicked within 12 months?

Step

Check the platform's records, and count only a person's clicks

Have the platform discard clicks in the first seconds after delivery and from known scanner addresses, and check the first campaign's clicks by hand. A click no person made does not start a support stage.

• Then: How many times has the person clicked within 12 months?

Decision

How many times has the person clicked within 12 months?

Count practice-email clicks in the last 12 months from the platform's results. Named results are kept for 12 months and then reduced to group figures, so an older click no longer counts.

• Once: Teaching page only; nothing more happens
• Twice: Offer a private coaching session within 10 working days
• Three times or more: Hold a support conversation; the line manager is told after the person

Outcome

Teaching page only; nothing more happens

Every click shows the teaching page at once, with the module for that kind of email offered. That is the first stage, and it involves the person alone.

Step

Offer a private coaching session within 10 working days

The awareness lead offers a private 20-minute session within 10 working days of the campaign closing: the cues, what makes them hard to spot in this person's work, and the report button. Taking it up is voluntary. Record only that it was offered and whether it was taken up, with no note of the conversation.

• Then: Does their role carry higher-risk access or authority?

Step

Hold a support conversation; the line manager is told after the person

The person, the awareness lead and, with the person told first, the line manager talk about workload, the role's email volume, and language or accessibility needs. HR joins only to arrange an adjustment. Record the support agreed; the record stays with the awareness lead, not in the personnel file.

• Then: Protect the account: phishing-resistant sign-in and a warning banner

Step

Protect the account: phishing-resistant sign-in and a warning banner

Move the person's account early to phishing-resistant sign-in, the stage of the privileged access rollout for everyone's remote access and email, and add a stronger warning banner on outside email. A person who keeps clicking is better protected by a control than by another email.

• Then: Pause their practice emails for 2 months

Step

Pause their practice emails for 2 months

Pause practice emails to the person while the support works. Never send extra or harder ones as a penalty.

• Then: Does their role carry higher-risk access or authority?

Decision

Does their role carry higher-risk access or authority?

Payment authority, administrator rights, the service desk's resets and the other roles at higher risk. The pack sets no separate route for a repeat clicker in such a role. Its principle is that a practice email never stands in for a control that would stop the harm.

• Yes, or not sure: Check the role's module is in date and its controls work
• No: After support, have they deliberately broken a rule in real work?

Step

Check the role's module is in date and its controls work

The pack sets no step here; this is your own judgement. Confirm that the person's role module was completed in the last 12 months, and that the controls that stop the harm in that role are in place, such as the call-back before a change to supplier bank details, or phishing-resistant sign-in for administrators. Where a control is missing, its owner fixes it.

• Then: After support, have they deliberately broken a rule in real work?

Decision

After support, have they deliberately broken a rule in real work?

A sanction belongs to the disciplinary process alone, and only where a person, after support, deliberately disregards a rule in real work. A practice-email result is never that evidence on its own, whatever the number of clicks. Removing access, pay or opportunities because of a practice-email result is never done.

• Yes, shown by real-work evidence: A matter for your disciplinary process, on real-work evidence
• No, not known, or only practice-email results: No sanction: support and protection continue

Outcome

A matter for your disciplinary process, on real-work evidence

Handle it under your own disciplinary procedure, with the evidence from real work. Practice-email results are never that evidence on their own.

Outcome

No sanction: support and protection continue

Keep offering support as the stages set it. Judge the programme on the group share of repeat clickers, never on a list of names, and reduce named results to group figures after 12 months.