CASE STUDY · HEALTHCARE
Safety starts with someone speaking up
A healthcare organization wanted to know how well-prepared its workforce was for phishing—and they wanted to be able to prove it. A report on 18 months of monthly simulations: what the initial assessment revealed, why the click rate is the less important metric, and how compliance evidence is generated without anyone having to track it down manually.
The starting point
Measured in the first campaign, without prior notice. Not to catch anyone out, but to have an honest baseline against which progress can later be proven.
Click rate in the first campaign. Almost one in three people opened the link in an email that looked like an ordinary appointment confirmation—without anyone noticing a thing.
Reporting rate. Only a fraction actively reported the attempt to IT. The actually alarming figure: those who do not click, but also do not report, do not protect the organization.
Employees in the program, from administration and specialized departments to external staff with system access. A group of people that is constantly changing.
Anyone who works with patient data on a daily basis is a rewarding target
Healthcare facilities process data that is worth many times more on the black market than payment data: diagnoses, insurance numbers, and treatment histories. At the same time, operations run under such time pressure that no one is checking email headers.
On top of that, there's a structure that plays right into the hands of attackers: high staff turnover, external service providers with system access, and external communication across numerous channels—with payers, referring physicians, laboratories, and suppliers. An email that looks like just another of the hundreds of routine messages received daily goes completely unnoticed. And that's precisely the problem.
As is so often the case, the catalyst was an external inquiry—asking for proof that didn't yet exist in that form. Not because no one had raised awareness, but because no one had documented it. Anyone scheduling training at short notice in this situation ends up with a piece of paper, but no indication of whether anything has actually changed.
The management therefore decided against the obvious solution. Instead of a one-off measure, a program was to be created that runs permanently, whose impact can be measured, and whose evidence is generated without anyone having to scramble to gather it afterwards.
Three conditions that have narrowed the solution space
No in-house security team
IT is designed for operations—keeping systems running, providing support. No one had the capacity to design monthly campaigns, write scenarios, and evaluate results. A self-configurable software license would have ended up sitting unused after four weeks.
Acceptance was the condition
A simulation that humiliates employees would have turned the staff against the program—and would have ended after the second round. In professions where people already work under pressure, shaming is not the way to go.
Supporting documents had to be provided
It is foreseeable that auditors, payers, or financial auditors will ask for documented security awareness. A program whose documentation has to be gathered together after the fact creates twice as much work—and is routinely incomplete.
First measure, then increase, then document
STEP 01
A baseline instead of a gut feeling
It all began with a single campaign. The staff had been informed in advance that a program was launching and that simulations would be part of it—just not when. The goal wasn't to catch anyone out, but to establish an honest baseline.
Two metrics were measured: the click rate—that is, how many people took the bait—and the reporting rate, meaning how many actively reported the attempt. The second number is the more critical one, yet it is overlooked almost everywhere. An organization where no one clicks, but no one reports either, is not secure—it is simply quiet. Security only happens when suspicious activity actually makes its way to IT.
Result of the first campaign: click rate 28%, reporting rate 6%.
The value was unpleasant, but not unusual. It corresponded to what we know from facilities without a prior program.
STEP 02
Scenarios from your own inbox
Generic phishing templates fail in the healthcare sector because they do not look like anything that actually arrives there. An alleged parcel service generates no response if no one is expecting packages. The campaigns therefore work with bait from the real inbox: appointment confirmations, invoices from suppliers, messages from payers, diagnostic reports, or alleged alerts from their own IT department.
Those who click don't end up on a reprimand page, but rather on a brief explanation: These were the three indicators by which this email could be identified. Those who report it receive positive feedback. This asymmetry is the real leverage. It shifts behavior toward reporting instead of hiding—and it is the reason why the reporting rate can increase in the first place.
STEP 03
The level of difficulty increases with it
A simulation that still uses the same patterns after six months only measures who has memorized the old examples. Therefore, the requirements were increased starting in month four. Later, patterns that are significantly harder to recognize were added: requests that seemingly came from management and arrived at the end of the month, precisely when everyone is under time pressure. Replies within existing email threads. Sender addresses that differ by only a single character.
The effect is intentional: the click rate rises again temporarily with a more difficult wave. That is precisely why the reporting rate is the more reliable metric—it remains stable when the organization has learned.
STEP 04
The proof is generated on the fly
Each campaign automatically generates documentation: date, number of participants, aggregated click and reporting rates, maturity level over time, and derived measures. Prepared in a format that management, auditors, and inspectors can work with directly.
The evaluation remains completely aggregated. There is no list of who clicked—and there never has been. This isn't just about being nice to employees. First, it is a requirement to ensure the program operates cleanly in compliance with Art. 6(1)(f) GDPR. Second, it is a prerequisite for people to report incidents in the first place. Anyone who fears that a report will be used against them simply won't report.
What has changed after 18 months
The click-through rate has decreased, and that is the number they ask for in board meetings. The other one is more meaningful.
Click-through rate. The metric the board asks for—and one that can be lowered simply by being cautious.
Reporting rate. Nearly half of the workforce actively reports a suspicion instead of silently deleting it.
Monthly effort on the client's side. Concept, distribution, analysis, and documentation are handled by us.
"We expected a program like this to meet with resistance. The opposite happened—colleagues are now coming forward on their own with screenshots and asking questions. The fact that we could simply send a report to the operating organization was the side effect we were actually looking for."
Management of the facility
What of this can be applied to your facility
Every institution is different—in terms of size, regulatory requirements, and system landscape. Nevertheless, three patterns apply across the entire healthcare sector.
No statement without a baseline
If you don't know where you are starting, you won't be able to prove any progress later on—neither to your own management nor to an auditor. The first campaign is not an action, but a baseline measurement.
The reporting rate is the more honest metric
Click rates can be reduced in the short term through fear. Reporting rates only increase when people trust that nothing will happen to them. Anyone who only measures the click rate is ultimately measuring the wrong thing.
Evidence belongs in the process
Documentation that is only created for an audit costs many times more—and inevitably has gaps right where people look.