There is a man, in a small town much like yours, who never robs a house until he has read the notice board in the parish hall.
He doesn’t need to break anything. The notice board tells him everything: who is away on holidays, whose daughter is getting married, which house has a new alarm and which has a new roof. People think of burglars as people who break in. This one reads.
Attackers, it turns out, read notice boards too. Press releases. Staff newsletters. A proud post about the new system. A cheerful “thank you to everyone who worked so hard this quarter.” Every organisation broadcasts a story about itself, and that story tells a crook what the people inside are feeling.
Why percentages mislead
Every month organisations run phishing simulations, hoping for tidy click rates. But those numbers are noisy. A busy morning can skew one week. A well-timed email can catch everyone off guard the next. You are dealing with people, not newsletter mailshots, and meaningful benchmarks would need datasets most organisations don’t have.
So shift the focus. The real value of a simulation lies in understanding human behaviour, and the story your organisation is telling about itself. Are you telling a growth story? A stress story? Are you rolling out new systems, rewarding staff, going through change? Those are exactly the stories attackers use.
The true bit: a cautionary tale
In June 2026, Newfoundland and Labrador Health Services ran a phishing test that offered staff “one additional paid day off” in recognition of the work behind a major system launch. Clicking the button earned a fail mark. Staff who had been working overtime and struggling to get leave were angry, unions objected, and the health board apologised, saying the theme was inappropriate.
The click rate wasn’t the lesson. The emotional insight was: burnout, and a hunger for recognition. It was also a reminder that a lure which presses on a real hurt can damage the trust that training depends on. Learn from it, and don’t copy it.
A People-Not-Percentages checklist
- Why did they click? Ask. What was convincing?
- What human trigger was used? Recognition, urgency, curiosity?
- What organisational story was exploited? Use OSINT to map the pretext to what your organisation is saying about itself right now.
The moral of the story
Attackers don’t target percentages. They target people, and the stories those people are living inside.
References
- CP24, These workers thought they were getting an extra day off. Turns out it was just a cruel test (21 June 2026).
- VOCM, NL Health Services apologizes for phishing exercise that baited health care workers (17 June 2026).
- SC Media, Canadian healthcare organization apologizes for insensitive phishing test.