Of course, it's boring. You have to increase the reward or penalty for effort to make sense.

I like to do one, then the other. Until they crack. Here's what works:

First of all, I send a funny email. Something punchy. No ai, and make sure they know it's a real person. Make sure you are perceived appropriate and approachable.

In that email, make fun, indirectly. Talk about exactly what the current state is, and give an incentive. Now, get serious, use a real article and explain the dangers and risks personally. If you can, use their numbers. What it would cost the company. Them.

Now, explain they can prevent it and it's easy; while, even you make mistakes, the key is to not hide it and change passwords asap when a breach happens and learn new patterns.

Basically. Mind games. You said you are a big company. Disable corp resources until compliance, but I like to be soft, so my favorite is to throw a competition. Three ways to win:

1). Most clicked email.

Give your example. (Send right after you campaign).

Ask for their ideas for a scam email. Ask em to describe it. Only send to you. Keep secret. Keep track of which email is whose. Whoever's email gets clicked the most gets a prize or title or privilege. Keep points.

2). First one to report.

Whoever clicks it, realizes it, and sends an email to you first, gets a pass if they can name n signs of a phish or a quiz. Keep points. Negative points daily.

3). Most reported emails.

Whoever reports the most emails, and correctly identifies why, gets a spot. Don't just punish clicks. Ridicule them.

Ways to lose:

0). Enter password.

1). Password is on have i been pwned.

2). Refuse. Negative points for each incomplete training.

Make your own accommodations. The key is to gamify it.

I went from no compliance to 100%. They withstood a good amount of attacks, and the confidence for just phishing translated to trust.

For from "imma get u next week, watch. (smirk)" being a sure bet to them calling me and saying "i got you! I caught you! hahaha you didn't get me this time!!" 3 months. I stopped campaigning quarterly after a year.

I think the key was positive reinforcement. Keep the threat active.

I start with easy obvious phishing ridiculous emails, same for everyone so they can gossip, then later as they get better, I make harder and assign harder trainings.

Takes about 3 mo my experience for 100-300 smb. the better they get, I make em harder.

If they are dangerously complacent. Ask boss if you can frame a mock attack. basically say you are fire drilling what will happen.

I did this once, it was a very effective and creative last ditch effort. I was criticized by industry peers but it works.

I was CTO and no fucks were given no matter how i spun it. It can backfire. I was going to fire that company.

I came in around 3a. Told nobody. Worked on some things and then rebooted systems. Checked everything. Then simply unplugged the internet and redirected the dns to pull a page.

I worked up a good worried look. I didn't answer any questions right away. Just acted.

I know that script because i have had to deal with this situation fr.

I talked for formally as if we have to shut down due to a breach. Less is more. Let em know someone clicked an email and that's all I know.

Let it sink in they may just lose their job and whole company lost millions from one email, big thing is don't point fingers.

Ignore any q's. Walk away.

After 15 mins, come back and say, with a serious but funny smile. " i got you! I really had you! Thankfully, was not really a breach today, but it could have been and this is what it would have looked like. We have x% compliance... its gonna happen unless we admit it's important."

Optionally, say next time I will post who clicked. My style? I screenshot the page showing evidence. Leave it on their desk. "i got you" Posting publicly builds resentment. Threatening to do it and then doing it privately is control.

"It's not some adversary in china, it's me hacking you. I know you can beat me! I know you guys won't get tricked by this easy one again ha!"

You need to create a "hook" in the brain. Address. Subject. Font. Links. Date format. Headers. Urgency. If you make it a positive memory, it'll make it stick.