Every statistic in cybersecurity points to the same root cause. The ASD's Annual Cyber Threat Report consistently lists phishing as the primary initial access technique for attacks on Australian organisations. The Verizon Data Breach Investigations Report places human involvement in over 68% of all breaches globally – and that figure rises when social engineering is examined specifically. The ACCC's Scamwatch data shows business email compromise losses in Australia reaching hundreds of millions of dollars annually – every one of which started with a person who was deceived.

Your technical controls – email security filtering, endpoint detection and response, vulnerability scanning, firewalls – stop the vast majority of attacks automatically. They do not stop a well-crafted spear phishing email that lands in a staff member's inbox looking exactly like a message from your CEO. They do not stop a phone call from someone impersonating your bank's fraud team. They do not stop a staff member who clicks a QR code on a printed notice left in the office car park.

These attacks target the human, not the system – and the only defence is a human who has been trained to recognise and respond correctly. For the latest thinking on how AI is making phishing simulations more effective at building this resilience, read: The Future of Cybersecurity: Integrating AI into Phishing Simulations.

The standard Australian business approach to security awareness training: one video, once a year, with a multiple-choice quiz at the end. Staff click through, tick the box, receive a completion certificate, and forget everything within a week. The organisation can demonstrate "staff received training." It cannot demonstrate that any staff member's behaviour changed.

This approach fails for three predictable reasons:

Volume without frequency creates no retention. Research on the forgetting curve consistently shows that without reinforcement, most of what people learn is forgotten within days. A single annual training session – however well-produced – produces compliance evidence, not behaviour change.

Generic content does not match specific risk. A finance manager's phishing risks are different from a receptionist's, which are different from a developer's. Generic training cannot address the specific scenarios that each role faces because it has no role context.

Testing only after teaching does not build resilience. Resilience comes from practising recognition under realistic conditions – not from answering questions about content you just watched. Ongoing simulation, where staff encounter realistic attacks without warning, is what builds genuine recognition reflexes.

Code Hyper One's Human Risk Management service is built on a completely different model: continuous testing, immediate feedback, short targeted training, and measurable improvement over time. The goal is not a completion certificate. The goal is a team that, six months into the programme, clicks on a materially lower percentage of simulated phishing attempts than they did in week one – and reports the ones they do receive to IT instead of panicking or ignoring them.

1. Ongoing Phishing Simulation Campaigns

Phishing simulations are the backbone of any effective HRM programme – but the design of those simulations determines whether they produce results or just produce data.

Campaign design principles:

• Ongoing schedule, not one-off events – simulations run on a continuous schedule throughout the year. Staff who received their last simulation six months ago have forgotten what to look for. Staff who received one last Tuesday are actively thinking about it today.
• Difficulty progression – campaigns start at a level appropriate for your team's current awareness and increase in sophistication over time. Sending highly sophisticated spear phishing to untrained staff produces only demoralisation. Building from foundational to advanced produces genuine resilience.
• Template variety – campaigns rotate through different attack categories: credential harvesting, malicious attachment, invoice fraud, IT support impersonation, delivery notification, and social media lure categories – mirroring the full range of real attacks targeting Australian businesses.
• Intelligence-driven lures – simulation templates are informed by current Australian threat intelligence. When a specific phishing lure is actively targeting Australian businesses in your industry, your team encounters a version of it in simulation before encountering it for real.
• Personalised targeting – advanced campaigns use information available about recipients (name, role, manager, department) to create more realistic, harder-to-detect simulations – the same personalisation technique used in real spear phishing.

Simulation metrics tracked:

• Click rate – percentage of recipients who clicked the simulated link or opened the attachment
• Credential submission rate – percentage who entered data on the simulated credential page
• Report rate – percentage who reported the simulated phishing email to IT (the behaviour we are ultimately trying to build)
• Time-to-click – how long after delivery did recipients click? Fast clicks indicate habitual, unreflective responses.
• Repeat clickers – individuals who fail multiple simulations over time and require targeted intervention

Phishing via email is the most common attack vector – but it is not the only one. Modern Human Risk Management extends simulation to every channel that attackers use to target humans.

Vishing (Voice Phishing) Simulations Simulated phone calls from our team impersonating IT support, bank fraud teams, government agencies, or executive assistants – testing whether staff disclose passwords, grant remote access, or take financial actions under telephone social pressure. Vishing attacks are disproportionately effective because the immediate social pressure of a live conversation prevents the reflective thinking that written communication allows.

Smishing (SMS Phishing) Simulations Simulated SMS messages containing malicious links, fake delivery notifications, account suspension warnings, and multi-factor authentication bypass attempts – testing whether staff click links on their mobile devices. Mobile devices are increasingly the target of choice for attackers because mobile browsers show less URL detail, mobile users are in more distracted contexts, and mobile security controls are typically weaker than desktop controls.

QR Code Phishing Simulations Simulated QR codes delivered via email, printed materials, or digital screens – testing whether staff scan unfamiliar QR codes without verifying the destination. QR code phishing ("quishing") has grown significantly in Australia as attackers use it to bypass email filtering that scans URLs but cannot process image-embedded links.

When a staff member clicks a simulated phishing email, two things are true simultaneously: they have just made the mistake the programme is trying to prevent, and they are in exactly the right psychological state to learn from it. Code Hyper One's HRM programme captures this teachable moment with immediate, targeted feedback.

What just-in-time coaching delivers: Rather than a generic reminder email sent later that day, staff who click a simulation immediately see a brief, specific explanation of what they missed – the specific tell in the email that they should have noticed, why that tell indicates a phishing attempt, and the exact action they should take next time (report, not click).

Coaching framing matters: The tone is educational, not punitive. Staff who are embarrassed or fearful of consequences hide their mistakes – meaning real phishing clicks go unreported. Staff who are coached without blame develop confidence in their ability to recognise and report attacks – meaning real incidents surface faster. This cultural shift from hiding mistakes to reporting them is one of the highest-value outcomes of a well-run HRM programme.

Repeat clickers receive escalated support: Staff who fail three or more simulations within a defined period receive targeted one-on-one coaching and additional module assignments focused on their specific failure patterns.

Generic security training produces generic awareness. Role-based training produces specific, relevant awareness for the actual threats each role faces.

Finance and Accounts Teams The highest-risk role for Business Email Compromise. Training covers: invoice fraud recognition, payment redirection scam identification, supplier impersonation patterns, verbal verification procedures for payment changes, and the specific urgency and authority language that BEC attackers use to bypass normal approval processes.

HR and People & Culture Teams High-risk for payroll diversion and W-2/tax fraud. Training covers: bank account change request verification procedures, payroll diversion attack patterns, new employee data handling obligations, and social engineering targeting onboarding processes.

Executive Leadership Targets of CEO fraud, wire transfer fraud, and executive impersonation. Training covers: what attackers know about executives from public sources, how to verify unusual urgent requests from within the organisation, whaling-specific phishing patterns, and the appropriate escalation process when something feels wrong regardless of apparent authority.

IT Staff and System Administrators Targets of technical social engineering for privileged access. Training covers: social engineering of help desk and IT support processes, pretexting for password resets and account access, the specific risks of over-helpful technical support behaviour, and verification procedures for privileged access requests.

General Staff – All Roles Foundational training covering: phishing recognition fundamentals, password hygiene and credential security, safe web browsing, data handling and sharing responsibilities, incident reporting procedures, and physical security awareness (tailgating, clean desk, device security in public spaces).

Contractors, Temporary Staff, and Third-Party Vendors Often excluded from security training programmes despite having network access. Our HRM programme includes lightweight onboarding training for non-permanent staff with access to your systems – a frequently overlooked risk vector.

Every new employee arrives with security habits formed at their previous employer – habits that may be better or worse than your current standards, and that may include behaviours explicitly unsafe in your environment. Code Hyper One's HRM programme integrates with your onboarding workflow to deliver baseline security training before new starters have full system access.

New starter onboarding training includes:

• Foundational phishing and social engineering recognition
• Your organisation's specific security policies and reporting procedures
• Password policy and multi-factor authentication setup guidance
• Data handling and acceptable use training relevant to their role
• First simulated phishing campaign within the first 30 days – establishing their individual baseline before the ongoing programme begins

This is the capability that separates Human Risk Management from security awareness training – and the capability that justifies the "management" in the name.

Every staff member in Code Hyper One's HRM programme has an individual Human Risk Score – a continuously updated risk rating based on:

• Simulation performance over time (click rate, credential submission rate, report rate)
• Training completion and module performance
• Time-to-detect in simulations (how quickly do they catch it?)
• Pattern of repeat failures (specific attack types they consistently miss)
• Improvement trajectory (are they getting better, staying the same, or getting worse?)

Individual risk scores aggregate into departmental risk benchmarks – showing which teams in your organisation carry the highest human risk, which have improved most over the programme period, and which require targeted intervention.

Organisational risk scores provide an overall Human Risk Posture – a single metric that captures your organisation's current human-layer security strength, comparable over time and benchmarkable against similar organisations in your industry.

Why the Human Risk Score changes everything: Without measurement, security awareness training is an activity. With measurement, it is risk management. The Human Risk Score gives you the same visibility into human risk that a vulnerability scan gives you into technical risk – a prioritised, actionable view of where the gaps are and where remediation effort is most needed.

Individual Reports Per-staff member simulation performance, training completion, risk score trend, and specific improvement areas – available to managers and HR for performance review integration.

Departmental Reports Team-level risk benchmarking, simulation click rate by department, comparison of risk scores across the organisation, and identification of specific departments requiring targeted intervention.

Executive and Board Reports Plain-language risk posture summaries showing: current human risk exposure as a percentage, comparison to prior period and industry benchmark, key incidents from the reporting period, programme activity summary, and strategic recommendations for the next quarter. Written for decision-makers who need to govern security risk without needing to understand simulation mechanics.

Cyber Insurance Documentation Security awareness training and phishing simulation records are increasingly required by Australian cyber insurers as evidence of human risk management controls. Code Hyper One's reporting produces the programme evidence, completion rates, risk trend documentation, and simulation frequency records that insurers request during application and renewal. For the full picture of what cyber insurers require in 2026, read our cyber insurance requirements guide.

Phishing simulation is the most important component of HRM because email phishing is the most common attack vector. It is not the only social engineering attack your staff face.

Code Hyper One's HRM programme addresses the full social engineering taxonomy relevant to Australian businesses:

Pretexting – creating a fabricated scenario (a fictional IT audit, a regulatory inspection, a supplier review) to extract information or access from staff who would not provide it if simply asked directly.

Baiting – leaving USB drives, QR codes, or other media in physical locations where staff might find and use them – exploiting natural human curiosity to deliver malware or capture credentials.

Tailgating and Physical Security – testing whether staff challenge unfamiliar individuals in secure areas, hold secure doors open for strangers, or allow access to areas requiring authentication. Physical social engineering testing is conducted under explicit written authorisation with clearly defined scope.

Business Email Compromise Simulation – targeted simulation of BEC attacks specifically, including realistic impersonation of executives and known suppliers, to test whether finance and senior staff follow verification procedures or act on email authority alone.

Romance Scams and Social Media Manipulation – increasingly used against executives and senior staff as an intelligence-gathering vector prior to targeted attacks. For Australian examples of how AI-enhanced social engineering is targeting business figures, read our analysis: The Anthony Albanese AI Scam and What It Means for Business Security.

For the technical breakdown of how phishing and spear phishing differ in their targeting and execution: Spear Phishing vs Phishing.

Human Risk Management does not exist in isolation. It is the human layer of a defence-in-depth security model – most powerful when it is connected to the technical controls it complements. Code Hyper One's HRM service is integrated with every other security layer we manage:

Email Security → HRM Our email security service filters inbound phishing before it reaches your staff. The attacks that bypass filtering become the basis for real-world-relevant simulation templates – meaning your training programme tests exactly the types of attacks currently evading your technical controls.

Dark Web Monitoring → HRM When our dark web monitoring service identifies staff credentials exposed in a data breach, those staff members are automatically flagged for targeted credential security training and required to complete password change and MFA setup training – because exposed credentials without awareness remediation is a ticking clock.

SOC/MDR → HRM When our managed SOC detects a post-phishing-click account compromise event – suspicious login, email rule creation, credential access – the affected user is added to a targeted coaching programme with specific training on the sequence of events that led to their account being accessed.

Penetration Testing → HRM Our social engineering penetration testing scope includes human-targeted attacks – targeted spear phishing campaigns, vishing operations, and physical security testing – providing a deeper, more adversarial assessment of human risk than simulations alone. HRM simulation results inform the social engineering scope of annual pen tests, focusing effort on the scenarios your staff currently fail most.

EDR → HRM When our managed endpoint security detects malware execution on an endpoint traced to a phishing link click, the incident data feeds back into the HRM programme – flagging both the user and the lure type for specific training intervention.

This integration is only possible because Code Hyper One manages all of these security layers for the same clients. A standalone security awareness training vendor has no access to your email security logs, your dark web monitoring alerts, or your SOC incident data – meaning their HRM programme is informed by simulation results alone. Ours is informed by everything happening in your environment.

ASD Essential Eight

The Essential Eight does not explicitly require security awareness training as a standalone control – but human behaviour directly affects the effectiveness of every Essential Eight control. Specifically:

• Restrict Microsoft Office Macros – staff must understand why macros are restricted and not attempt to bypass the policy
• User Application Hardening – staff must understand what legitimate software looks like and report unexpected installation attempts
• Multi-factor Authentication – staff must understand MFA fatigue attacks and not approve suspicious MFA prompts

At Maturity Level 3, the Essential Eight explicitly requires that users are trained to report suspicious activity. Code Hyper One's HRM programme builds this reporting behaviour through simulation and coaching. For the full Essential Eight framework, read our Essential Eight Checklist 2026.

Privacy Act 1988 – Notifiable Data Breaches

The Privacy Act's Australian Privacy Principles require organisations to take "reasonable steps" to protect personal information. Staff who fall for phishing attacks are a documented cause of Privacy Act breaches in Australia. Implementing a structured, documented HRM programme with measurable outcomes provides evidence of reasonable steps – which is directly relevant to Privacy Commissioner investigations following breaches caused by phishing or social engineering.

APRA CPS 234

For financial services entities, information security capability must be commensurate with threats – and human social engineering is one of the documented primary threats to financial services organisations. A managed HRM programme with documented simulation results, risk scoring, and improvement metrics provides the evidence base for APRA supervisory review of human risk management controls.

Cyber Insurance

Australian cyber insurers now routinely ask for: evidence of regular phishing simulation testing, staff security awareness training completion records, and multi-factor authentication deployment – during underwriting and policy renewal. Code Hyper One's HRM reporting provides all of this documentation automatically. For the full insurer requirement picture, read our cyber insurance requirements guide.

Week 1 – Baseline Assessment We import your staff list, configure your HRM platform with your organisation structure (departments, reporting lines, roles), and deploy your first baseline phishing simulation campaign. The baseline campaign uses medium-difficulty templates to establish current click rate and report rate benchmarks before any training has begun. This baseline is the "before" measurement that all subsequent improvement is measured against.

Week 2 – Platform Configuration and Training Assignment Role-based training modules are assigned to each staff group. New starter onboarding content is configured for integration with your HR onboarding process. Reporting dashboards are configured for your management and board reporting cadence.

Week 3 – Baseline Results and Initial Training Launch Baseline simulation results are reviewed with your designated HR and IT contacts. Initial training module assignments activate. Staff begin receiving their first short training modules, typically 3–5 minutes each, delivered in the flow of their working day rather than as a scheduled interruption.

Weeks 4–12 – Programme Running State Phishing simulations run on the configured schedule. Just-in-time coaching activates for staff who click. Training module completions are tracked. Monthly reports are generated. Any staff identified as high-risk from the baseline receive priority attention.

Ongoing – Continuous Programme Management Quarterly programme reviews assess risk score trends, adjust simulation difficulty based on improvement patterns, introduce new lure categories in response to current threat intelligence, and refresh training content to maintain staff engagement. Your Human Risk Posture score is presented quarterly alongside technical security posture metrics in a unified security review.