Most awareness programs are measured by a single number: the click rate on a simulated phishing email. The number is easy to report and hard to defend, because it says little about whether employees can recognize the techniques attackers are using now. Threat intelligence security awareness training closes that gap. It takes the social-engineering tactics observed in current campaigns, including those targeting organizations in the Kingdom, and turns them into scenarios and measurements that a board can understand.
This article sets out when an organization needs this approach, which three tactics to simulate, how to build and score the templates, and what a good outcome looks like.
When this approach becomes necessary
A generic simulation usually fails quietly. The template is a fake parcel notice or a password-expiry warning, employees learn to spot it, and the results improve. Meanwhile the messages that actually reach inboxes have changed. Signs that it is time to rethink the program include:
- Click rates are low and stable, yet real incidents still begin with a user action.
- Simulation templates have not changed in more than a year.
- Reported suspicious emails are mostly obvious spam, while sophisticated lures go unreported.
- The security team cannot explain to the budget committee what the training has changed in employee behavior.
- Threat-intelligence feeds are consumed by the SOC but never reach the awareness team.
The last point matters most. The intelligence your organization already collects describes how attackers approach people. Awareness is where that knowledge should be put to use.
Three tactics your scenarios should simulate
The right tactics depend on what your own intelligence sources show. For most Saudi financial institutions, three categories deserve a place in the annual scenario plan because they are designed to pass through technical controls and depend on human judgment.
1. Impersonation of trusted authority and internal roles
Attackers pose as executives, finance approvers, regulators, or IT support, often using a believable business context such as a payment approval, an audit request, or a policy update. Messages of this kind contain little that a filter can flag: no malicious attachment, sometimes no link. The scenario should test whether an employee verifies an unusual request through a separate channel before acting.
2. Multi-step and conversational lures
Many current campaigns begin with a harmless message that builds a conversation before any request is made. The first email contains nothing to detect. The risk appears on the second or third exchange. A single-email simulation cannot test this. Scenarios should run as short sequences and record at which step, if any, the employee reports or stops.
3. Credential capture through legitimate-looking services and channels
Attackers increasingly use shared-document notifications, meeting invitations, QR codes, and messages delivered by phone or messaging apps rather than email. Because these arrive through trusted services or outside the email gateway, controls see little of them. Scenarios should test whether employees recognize a login request that arrives through an unexpected route, and what they do next.
Confirm each of the three against your own intelligence before adopting it. If your feeds show a different pattern, such as targeting of customer-service staff or branch teams, substitute it. The method matters more than the exact list.
The template method: from intelligence to measurable scenario
The method has five steps and can be repeated each quarter.
- Collect the patterns. Gather the social-engineering observations from your threat-intelligence sources, incident records, and reported emails. Note the pretext, the channel, the request, and the urgency cue used.
- Select by bypass. Keep the patterns that are most likely to pass your technical controls. A lure your gateway reliably blocks is a poor use of training time.
- Write the template against a named pattern. Each template should be tied to one observed technique, with the indicators employees should notice written down in advance. This is what makes recognition measurable.
- Adapt to the role. Finance approvers, call-center staff, and executives face different pretexts. Match the scenario to the audience, and keep language and context appropriate to the Saudi business setting.
- Retire and refresh. Remove templates that no longer match current activity and add new ones as the intelligence changes.
Measuring recognition, not just clicks
A click rate records one outcome. To justify a budget, measure what employees recognized and when. Useful measures include:
- Report rate by template: the share of recipients who report the message, compared across techniques.
- Time to report: how quickly the first reports reach the security team.
- Step of detection: for multi-step scenarios, the point at which employees stopped or escalated.
- Verification behavior: whether employees used an independent channel to confirm an authority request.
- Trend by role and department: where recognition is improving and where it remains weak.
Compare the same technique across quarters rather than comparing different templates against each other. A hard template will produce a worse result than an easy one, and that does not mean the program has declined. Tracking each technique over time shows the board whether recognition of current campaign patterns is improving, which is the question a training budget should answer.
Regulatory context
Saudi financial institutions operate under expectations from SAMA, including its Cyber Security Framework, and from the National Cybersecurity Authority through its Essential Cybersecurity Controls. Both address security awareness and training as part of a managed program. Evidence that training reflects current threats and produces measurable results supports those expectations better than attendance records alone. Confirm the exact requirements that apply to your institution against the current published texts.
What a good outcome looks like
After two or three cycles, a mature program shows the following:
- Scenarios are traceable to specific observed techniques.
- Employees report sophisticated lures, not only obvious spam.
- The security team receives reports sooner, and the awareness function and the SOC share information routinely.
- Reporting to the board shows trends by technique and role, with clear reasons for each change in the scenario plan.
How CISO Consulting approaches it
CISO Consulting's Security Awareness service provides customized training programs to build a security-first culture across your organization. Customization is what allows scenarios to be matched to your roles, your channels, and the threats relevant to your institution rather than to a generic template library.
If your simulations have not changed with the threat picture, or you cannot yet show the board what employees now recognize, a conversation with our Security Awareness team is a practical first step.
