Stay up-to-date with the latest insights, case studies, and expert articles on human risk management, cybersecurity, and the power of adaptive phishing simulations. Learn how Fraus can help your team stay secure and informed.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Picture a finance clerk opening the calendar before a Monday payment run. Between two real meetings sits an event nobody accepted, "Final Notice: Payroll Acknowledgment Required," with a link in the description, and nothing was clicked or downloaded to put it there. This is calendar phishing, and this post is for security awareness managers in the UAE and GCC who need to explain it to staff and test for it.
In short: Calendar phishing puts a fake event on a calendar through an invite file, so staff meet it inside a trusted app. Train people to treat unexpected invites like unexpected email, report them, and test them with realistic simulations.
How Calendar Phishing Works
Attackers email a calendar file, usually with the .ics extension, and the event can land on the recipient's calendar without any action from them, as an IT security notice from a New York college describes. Because the event sits inside an app people trust, and the invite can get past email filters, it is harder to spot than a message in a spam folder.
The event itself carries the lure. Titles borrow urgency from finance, such as an invoice, an overdue payment or a crypto purchase, and the description pushes the reader to click a link, open a file or call a phone number, as a university warning from October 2025 lays out. Some invites appear to come from the organization's own domain while the real sender is someone else.
That makes calendar invite phishing a different problem from the phishing email staff already learn to distrust. The reader never decides to open anything. The first decision they make is what to do with an event that is already there.
Why ICS Phishing Reaches Staff Unchecked
Many calendar apps can add invitations on their own, which is why these events often appear without the recipient doing anything, as the college notice puts it. So the setting that decides whether a fake invite appears at all often belongs to IT, not to the employee.
The New York college changed its domain-wide settings so that invitations from external senders staff had never interacted with no longer appear until they accept them. It still asked staff to set their own calendars to add invitations only if the sender is known. Settings cut the volume. A person still has to judge what remains, including invites that look like they come from inside the organization.
Attackers are also moving away from the inbox in general. The 2026 Verizon Data Breach Investigations Report reports that mobile social engineering, such as fake texts and voice calls, has a success rate 40% higher than traditional email phishing. A calendar event is another place outside the inbox where a lure can arrive, and an invite that asks the reader to call a number borrows the same phone-based pressure.
What Malicious Meeting Invitations Look Like
The warnings from the college and the university list the same few signs. Staff can check them in seconds:
An organizer they do not know, or a familiar name with an address that does not match
Money words in the title: invoice, overdue payment, payroll, crypto
Urgent wording such as "payment will be processed within hours"
A link or attachment that asks for login details
A phone number in the description
None of this needs technical knowledge. It needs a pause, and the pause is what training has to build, because an event already on the calendar feels as if someone has accepted it.
Train Staff to Spot Fake Invites
Teach the report path first. Both institutions tell staff not to click links, open attachments or call numbers in an unexpected event, and to report it as spam before deleting it. Staff need that exact sequence in the language they work in, on the calendar they use. Codex delivers micro-learning in Arabic and English for this kind of habit.
Simulate the channel. Training explains the risk. A simulation shows what people do when an invite appears on a Monday morning. Whitebait runs phishing simulation for UAE and GCC organizations in Arabic and English and tracks the reporting rate next to the click rate, which is the pair of numbers to read after an invite test. Base the invite on a real example from a public warning.
Match the lure to the role. A finance clerk sees invoice and payment invites, an HR officer sees payroll acknowledgements, and an executive assistant who manages other people's calendars accepts invites all day. Each role needs its own version of the test.
Calendar invites are one of several places where a fake request arrives inside a trusted app. Our post on fake helpdesk chats in workplace messaging covers one of the others, and the post on AI phishing attacks covers how better written lures change what employees see.
Run One Calendar Test This Month
Go back to the finance clerk's Monday. Ask IT whether invitations from unknown senders add themselves to calendars in your organization, and set the known-senders rule if you can. Then send one simulated invite to a single team and compare how many people report it with how many click. The result shows which team needs training first.
Frequently Asked Questions
What is calendar phishing?
Calendar phishing uses a calendar invite, often an .ics file, to place a fake event on a victim's calendar. The title creates urgency, and the description holds a link, an attachment or a phone number. Because the event appears inside a trusted app, staff may trust it more than a suspicious email.
Can a malicious invite do harm without a click?
The fake event can appear without any action from the recipient, but the harm starts when someone clicks a link, opens an attachment or calls the number in it. Staff who leave the event alone and report it have avoided that lure, which is why reporting habits matter more than spotting every invite.
How can IT reduce calendar invite phishing?
Check whether your calendar platform adds invitations automatically and which option it uses. Where it is available, limit automatic additions to known senders so that events from strangers do not appear until someone accepts them. Administrators can often apply this across the whole organization, as the New York college did for external senders.
What should an employee do with a suspicious invite?
Do not click links, open attachments or call numbers in the event. Report it as spam using the calendar's report option, then delete it. If they already clicked or entered credentials, they should reset the password at once and contact the security team.
How do you test staff for ICS phishing?
Send a simulated invite with a realistic title and link to a small group chosen by role, such as finance or HR. Measure how many people report it next to how many click, then repeat with a different lure so staff learn the pattern and not one wording.
In a phishing study with 101 volunteers, run by a team that included authors from Harvard Kennedy School, emails written by an AI agent got a 54% click rate, the same as emails written by human experts. This post is for CISOs and security leads who need to explain what AI phishing attacks change and how to train staff for them. The study dates from late 2024, and the tools have not stood still since.
In short: AI-powered phishing removes the typos and clumsy wording employees were taught to spot. Train people to check the request, the sender and the channel instead, and test them with current, personalized lures that change as the attacks do.
What AI Phishing Attacks Change
Quality, every time. The UK's National Cyber Security Centre assessed in January 2024 that generative AI can already produce lure documents without the translation, spelling and grammar errors that often expose phishing, and expected this to increase over the following two years (NCSC assessment). The attack is still a lure that asks for a click, a login or a payment. What changes is that it now arrives well written.
In the Harvard Kennedy School study, an AI agent searched the web for each volunteer's interests, professional background and collaborators, then wrote an email around them. Those emails reached a 54% click rate, level with the human experts, and AI emails reviewed by a person reached 56%. A generic phishing email used as the control reached 12% (Heiding et al., 2024).
The sample was small and university-based, so read the numbers as a direction for your own testing, not a forecast. The cost side points the same way: the authors estimated about four cents in API costs per AI-generated email. Writing a personal lure no longer takes an attacker an afternoon.
Why the Old Red Flags Fail
Most awareness material still lists spelling mistakes, odd grammar and a generic greeting as warning signs. The UAE Cyber Security Council's December 2025 public advice still tells people to look for spelling or language errors. In the same messages it warns that criminals use AI to impersonate individuals and institutions with growing realism (Gulf News report). A message can pass the spelling check and still be hostile.
The NCSC went further and warned that generative AI will make it hard for everyone to spot phishing, spoofing or social engineering attempts, regardless of their cybersecurity knowledge. For staff who read both Arabic and English, translation slips were one more tell, and those are among the errors the NCSC says AI removes.
That moves the useful question from “does this look wrong?” to “should this request exist?”. A change of bank details, a login prompt behind a link, a request to keep something quiet and a demand for speed stay suspicious however well they are written. The Council's April 2026 awareness campaign makes a similar point when it calls the human element the most critical component in cybersecurity (Gulf News report).
Training for AI-Powered Phishing
Training that works against AI-written lures teaches a short routine employees can run in the few seconds they have. It does not depend on the message looking odd.
Ask who is writing, and whether they normally contact you through this channel.
Look at what is requested: money, credentials, secrecy or speed.
Confirm through a second channel you already trust, never the one inside the message.
Report the message, including when you have already clicked.
Simulations need to move the same way. A fixed template library written two years ago still tests the old red flags. Whitebait runs AI-recommended campaigns in Arabic and English, and Dolus AI Studio turns a screenshot of a real suspicious email, or a short prompt, into an editable template, so the lure that reached your staff this week can become a simulation template.
For the roles you rate as most exposed, Blackbait runs OSINT reconnaissance on selected targets and escalates attacks autonomously. That is closer to what the study's AI agent did than a broadcast campaign is.
Measuring Generative AI Phishing Readiness
A click rate on its own says little once the lures look clean. Track the reporting rate next to it, along with how long reports take and whether the same people repeat the same mistake. The method in Phishing Simulation UAE: What to Check Before You Buy shows what to ask of any platform, including whether it tracks reporting rate next to click rate.
Difficulty should follow the person, not the calendar. Our post on adaptive phishing simulations covers how to raise or lower the challenge by role and past behavior, which is how a program keeps pace with attackers who personalize.
Next Step for Security Leaders
Take the lure your own staff reported most recently and check whether it contains a single spelling mistake. If it does not, your simulations should not either. Rebuild that lure as a template, send it to one department, and compare the reporting rate with your last campaign. The gap between that result and your old template is the size of the problem.
Frequently Asked Questions
Can employees still spot AI-generated phishing emails?
Sometimes, but not by looking for mistakes. The NCSC expects generative AI to make phishing, spoofing and social engineering hard for everyone to spot, whatever their cybersecurity knowledge. Employees do better when they check the request itself: who is asking, what they want, and whether it can be confirmed through a second channel they already trust.
What is generative AI phishing?
It is phishing in which a generative AI model writes or personalizes the lure and sometimes researches the target. In the Harvard Kennedy School study, an agent built profiles from public web sources and wrote each email around them. The goal is unchanged: a click, a login or a payment. The writing is faster, cheaper and cleaner.
Do we need new training for AI-powered phishing?
Keep the fundamentals and change the examples. Replace error-spotting with request checking, refresh lures so they match what attackers send now, and set difficulty by role. Deliver it in the languages your staff work in, and measure reporting and repeat behavior, not only whether people clicked.
The FBI has warned that attackers are emailing a short code and telling the reader to enter it on a real Microsoft page. Device code phishing works because nothing on that page is fake, which is why it slips past the habits most employees have learned. This post is for SOC leads and security awareness managers who need to explain the lure in plain terms.
In short: A device code lure asks you to type a code, sent by someone else, into a genuine Microsoft sign-in page. That approves the attacker's device, not yours. Employees should never enter a code they did not request themselves, and should report the message.
How the Device Code Lure Works
Device codes exist for devices that are awkward to type on. A smart TV or a printer shows a short code, and you enter it on a phone or laptop to approve the sign-in. The standard behind it, RFC 8628, published in August 2019, warns that the flow can be started on a device in an attacker's possession.
OAuth device code phishing turns that design against the user. It runs in four steps:
The attacker asks Microsoft for a device code, which expires after about 15 minutes.
A message gives the code to the target with a reason to enter it, such as a shared document, an invoice, a meeting ID or a security check.
The target opens the real Microsoft device login page, types the code, signs in and approves MFA as usual.
The attacker's device receives access and refresh tokens and can read mail and files without ever seeing a password.
Email is only one route. CyberScoop reported in February 2025 that a campaign attributed to a suspected Russia-aligned group, aimed at governments and organizations in regions that included the Middle East, built rapport over messaging apps such as Teams, WhatsApp and Signal, then sent fake Teams meeting invitations that presented the code as a meeting ID.
Why Microsoft 365 Device Code Phishing Works
Most awareness advice tells people to check the address bar and distrust unfamiliar login pages. In Microsoft 365 device code phishing the address bar is correct and the page belongs to Microsoft. The employee follows the advice and still hands over access.
The FBI describes a phishing-as-a-service kit that captures access and refresh tokens and gets around MFA without intercepting the user's credentials, because the victim approves the sign-in themselves. In May 2026 Australia's national cyber agency said it had received a number of reports of the same activity against Microsoft 365 users, as Information Age reported.
The scale is already large. A research note from the Cloud Security Alliance reports 340 or more Microsoft 365 organizations in five countries hit by one phishing-as-a-service campaign by mid-March 2026, across construction, manufacturing, financial services, healthcare and local government. That is less than seven years after the device code standard was published.
That scale explains why response matters as much as prevention. The same research note says a password reset alone does not end access, because the stolen refresh token keeps working until sessions are revoked.
What Employees Should Never Enter
Give people a rule short enough to remember at their desk, and put it where they sign in:
Never enter a code on a Microsoft page that someone else sent you, whatever the message calls it: one-time password, access code, verification token or meeting ID.
Never approve a sign-in you did not start yourself.
Treat any request to verify a document, invoice or meeting by typing a code as a lure, even when the page is real.
Report the message instead of replying, and say whether you already entered a code.
The last line matters most to the SOC. An employee who reports within minutes gives your team time to revoke sessions and review registered devices, mail forwarding rules and OAuth consents, which are the response steps the Cloud Security Alliance note lists.
Device Code Phishing Awareness in Practice
Knowing the rule is different from applying it when a message appears to come from a finance director on the day of a payment run. A phishing simulation that asks employees to type a code or approve a sign-in shows you who stops and who reports. Whitebait runs MFA bypass scenarios in Arabic and English and tracks reporting rate next to click rate, which tells you whether the rule held.
Role matters here. Finance staff, executive assistants and help desk teams handle the documents and meeting invites that lures imitate, so they should see harder and more frequent scenarios. Add short training in Arabic and English through Codex, and give people a one-tap way to report from inside Microsoft Teams with the Fraus Teams App. The chat version of this pattern is covered in Microsoft Teams phishing.
Controls That Back the Rule Up
Awareness works best next to configuration. The FBI recommends a conditional access policy that blocks device code flow for all users, with narrow exceptions for documented business needs, and an audit of current use first so legitimate dependencies are found.
Blocking the flow removes the lure's payoff. Training then covers the cases the policy cannot, such as an exception you had to keep or a different sign-in prompt built on the same trick.
A Practical Next Step
Picture the accounts payable clerk who receives a message asking for a code to open an invoice. This week, ask your identity team whether anyone still uses device code sign-in, and send employees the four-line rule above.
Then schedule a simulation for the roles most exposed and compare reporting rate with click rate after the first round. That gives you a number to take to the next security review.
Frequently Asked Questions
What is device code phishing?
It is an attack that abuses the device sign-in feature. The attacker starts a sign-in on their own device, then convinces a victim to enter the matching code on the real Microsoft page. The victim's approval gives the attacker tokens for the account, with no fake website involved.
Does MFA stop device code phishing?
Not on its own. The victim completes MFA while approving the attacker's request, so the prompt is genuine. The FBI notes the kit it describes gets around MFA without intercepting the user's credentials. Blocking device code flow with a conditional access policy removes the payoff for most users.
Is device code phishing a Microsoft vulnerability?
No. The Australian Signals Directorate said it is not a technical flaw in Microsoft systems, as Information Age reported. Attackers abuse the legitimate Microsoft login page. The feature works as designed, which is why user behavior and policy controls both matter.
What should an employee do after entering a code?
Report it to the security team immediately and do not wait to see whether anything happens. The SOC can revoke the account's sessions, check for new registered devices and mail forwarding rules, and review OAuth consents. A password change alone will not remove the attacker.
Microsoft Teams phishing often starts with a chat message from someone who says they work in IT support. In April 2026, news reporting described security researchers tracking intrusions that began this way, with an outside account contacting employees about an account problem or a security update. This post is for security awareness managers who need to explain the pattern to staff and give them a clear way to verify and report it.
In short: attackers message employees from outside the organization, pose as the helpdesk and ask for remote access. Employees stay safe when they check the external label, confirm the request through a channel they start themselves, and report the chat at once.
How Teams Phishing Attacks Unfold
The reported pattern is simple. An account outside the victim's organization opens a chat, claims to be helpdesk staff and says something needs fixing. The pretext is an account issue or a security update, and the ask is to start a remote support session so the "technician" can help.
That session is the whole point. Once the employee hands over control of their machine, the attacker works from inside a trusted device. The researchers described the steps that followed: reconnaissance on the machine, malicious files placed in folders the user can write to, persistent access, movement to other systems, and data copied out to external cloud storage.
Nothing in that chain needs a malicious attachment or a lookalike login page. It needs one employee to say yes to a friendly request, which is why these Teams phishing attacks are a human problem before they are a technical one.
Why Microsoft Teams Phishing Works
Staff learn to distrust email from strangers. Teams feels different, because it is the place where colleagues, managers and the real helpdesk already talk. A chat window carries an unspoken sense that the sender belongs there, and a short, polite message from "IT" matches how internal support really sounds.
The numbers behind the wider problem are consistent. Verizon's 2026 Data Breach Investigations Report found the human element was present in 62% of breaches, up slightly from 60% the year before.
Verizon also reports that in phishing simulations the median click rate for mobile-centric lures such as voice and text messages is 40% higher than for email. Teams chat is not a text message, but the lesson carries over: lures that arrive as a conversation, in real time, are harder to resist than a message that sits in an inbox.
Spotting Teams Helpdesk Impersonation
Teams already gives employees one reliable signal. Microsoft's documentation says an external label appears at the top of a chat when it includes participants from outside the organization, and a label also sits beside their names. Researchers advise treating external Teams contacts as untrusted by default, and staff should be told the same thing in plain words.
A helpdesk contact that shows the external label and claims to be your own IT team is already a mismatch. Beyond that, give employees a short routine to run before they respond:
Look for the external label on the chat and beside the sender's name.
Be wary of urgency: a locked account, an expiring password or a security update that must happen now.
Never start a remote support session, read out a code or share a password because a chat asked you to.
Confirm the request through a route you start yourself, such as a ticket in the service portal or the helpdesk number on the intranet.
Stop replying, and report the chat.
Publish the routine in Arabic and English, with screenshots of how the label looks in each Teams display language your staff use.
Reporting a Suspicious Chat
Verification protects one employee. Reporting protects everyone else, because the same account usually messages many people in the same week. If the first person to see the chat reports it quickly, the security team can warn colleagues, block the sender and check whether anyone already accepted a remote session.
Reporting has to be easier than ignoring. The Fraus Teams App puts one-tap phish reporting inside Microsoft Teams, next to Odin risk scores, policy acknowledgement and micro-training, so an employee can raise the alarm without leaving Teams.
Tell staff what happens after they report: who reads it, how fast they will hear back, and that nobody is blamed for reporting a chat that turns out to be harmless. People report more when the answer is a thank you.
Training for Microsoft Teams Social Engineering
One awareness slide will not hold up against Microsoft Teams social engineering, because the lure changes with each attacker. Training works better when it is matched to the person. Helpdesk staff, finance teams and executives face different pretexts, and each group should see examples that look like their own working day, in Arabic and in English.
Pair that with measurement. A phishing simulation platform such as Whitebait tracks reporting rate next to click rate, and the reporting rate is the number that tells you whether staff would raise a fake helpdesk chat. Short micro-learning in Codex, in Arabic and English, can then follow up with the people who show a gap.
Your Next Step
Picture the employee from the opening, looking at a chat from "IT" about a security update. This week, write the one-page routine above, agree who owns reports of suspicious chats, and tell staff how fast they will get an answer.
Then check that every employee can find the report button in under ten seconds. If they cannot, fix that before you add more training.
Frequently Asked Questions
What is Microsoft Teams phishing?
It is the use of Teams chats, calls or meeting invites to trick employees into giving up access, credentials or data. A common version is a fake helpdesk contact from an outside account that asks the employee to start a remote support session or approve a security update.
How do I know a Teams message is from a real helpdesk?
Check for the external label first. Then confirm through a route you start yourself, such as a ticket in the service portal or the helpdesk number on the intranet. Do not rely on the chat itself to prove who the sender is.
Should employees ever accept a remote session from a Teams chat?
Not from an unsolicited chat. Your policy should state that remote access is only granted for a request the employee raised themselves, through an approved channel. Anything else is treated as suspicious and reported.
How should employees report a suspicious Teams chat?
They should stop replying and report it straight away through the route your security team has set. The Fraus Teams App offers one-tap phish reporting inside Microsoft Teams, so reporting takes seconds and happens inside Teams.
Can phishing simulation cover Teams helpdesk impersonation?
Simulation builds the habit the attack tests: pausing, verifying and reporting. Track reporting rate and time to report next to click rate, and use role-based scenarios so helpdesk-style pretexts reach the people they would target.
In phishing simulations covered by the Verizon 2026 Data Breach Investigations Report, the median click rate on mobile lures such as text messages and voice calls is 40% higher than on email. A company-wide average cannot show who receives those lures or what they can reach if one works. This post is for CISOs and GRC leads who need a human risk assessment they can run across departments and turn into a plan.
In short: Map roles by what they can reach, collect behavior signals per department, score exposure and behavior together, then convert the ranked gaps into owned actions with dates. Repeat the cycle so the assessment stays current.
What a Human Risk Assessment Should Answer
A human cyber risk assessment is a structured look at how people's behavior and access combine into risk for the organization. It should answer three questions for each group: what could this role do that causes harm, how does this group behave when targeted, and what is already in place to limit the damage.
Most teams can answer the second question for the whole company and none of the first for any single team. That gap is why the output of a first assessment often reads as a table of averages, and why nobody owns the next step.
If you already have a per-person number, the Human Risk Score post covers what should go into it. This post covers the layer above it, which is how you read many scores across roles and departments and decide what to do first.
Map Roles by What They Can Reach
Start with access, not with the org chart. An accounts payable clerk who can release a payment, an IT administrator with privileged accounts, an executive assistant who manages a director's inbox and a new joiner with default permissions are four different risk positions, even if all four sit in one email domain.
For each role, record the systems and decisions it touches. Keep it short enough to finish in a week.
Money movement. Who can approve payments, change bank details or release vendor invoices.
Sensitive data. Who handles customer records, health data, designs or contracts.
Privileged access. Who administers systems, mailboxes or identity.
Public profile. Whose names, titles and travel appear online, which is what an attacker researches first.
This list is the criticality side of an employee cybersecurity risk assessment. It tells you how costly a mistake is before you have measured how likely one is.
Collect Signals Department by Department
Likelihood comes from behavior. For each department, gather what you already hold: simulation click and reporting rates, time to report, repeat behavior, training completion and policy acknowledgement. Reporting matters as much as clicking, because a team that reports quickly gives your security operations team a warning.
Compare departments against each other and against themselves over time. Finance may click less than sales and still be the larger concern because of what it controls. The role map from the previous step is what lets you read the two side by side.
Mobile and voice lures deserve their own line. The 2026 Data Breach Investigations Report found that in phishing simulations the median click rate on voice and text lures is 40% higher than on email, so a department that has only ever been tested by email has a blind spot in its data.
Fold language and working pattern into the picture too. A team that works mainly in Arabic, or on shifts away from a desk, needs simulations and training in the same language and on the same channels it uses at work.
This is the work that continuous scoring automates. Dynamic Human Risk Modeling in Fraus combines behavioral signals, role and exposure into a continuous risk score, and Odin keeps an individual threat profile for each employee, so the department view is built from current data and not from a yearly snapshot.
Turn Findings Into a Plan
Rank groups by exposure multiplied by behavior, then look at the top five. For each one, write a single action with an owner and a date. Vague actions such as raising awareness do not survive the next quarter.
Match the action to the gap you found:
Low reporting rate: run simulations that ask for a report as the success condition, and tell people what happened to their report.
High click rate on one channel: add that channel to the simulation mix at the right difficulty for that role.
High criticality, thin controls: add a process control such as call-back verification for bank-detail changes.
Repeat behavior: assign short, targeted training right after the event, not at the next annual cycle.
Simulation and training sit inside the plan, not beside it. Whitebait runs phishing simulations in Arabic and English, including QR code and credential harvesting scenarios, and tracks reporting rate next to click rate, which is the pairing this step depends on. The comparison with generic programs is covered in Human Risk Management vs Security Awareness Training.
Plan for repetition. NIST SP 800-50 Revision 1 introduces a life cycle model for learning programs that allows for ongoing, iterative improvement and sets out how to approach measuring their impact. A quarterly cycle of assess, act and reassess puts that model into practice and gives the board a trend instead of a one-off number.
Run the First Assessment Next Month
Return to the finance clerk from the role map, the one who can change a bank detail. Pick that team and one other as pilots. Map their access, pull the last two quarters of signals, set one action each and put a date on the review. NIST's SP 800-50 Revision 1 is a useful reference for structuring the cycle.
Once the pilot teams show a clear before and after, extend the same template to the remaining departments in order of exposure.
Frequently Asked Questions
How often should we run a human risk assessment?
Reassess on a fixed cycle, quarterly for most organizations, and also after a role change, a reorganization or a real incident. Continuous scoring keeps the data current between cycles, so the quarterly review focuses on decisions and not on collecting numbers.
What is the difference between a human risk assessment and a phishing simulation?
A simulation produces one kind of behavioral signal. The assessment combines that signal with role criticality, access, training and reporting data to rank groups by risk and decide on actions. Simulations feed the assessment and then act on its findings.
Who should own the assessment, security or HR?
Security or GRC usually owns the method and the data. Department heads own the actions for their teams, and HR supports on role data and training time. A named owner per action matters more than where the program sits on the org chart.
Can one employee cybersecurity risk assessment cover every department?
One method can cover all of them, but the inputs differ. Finance is assessed on payment controls, IT on privileged access, and customer-facing teams on data handling. Use the same scoring structure so results can be compared across the company.
The UAE Cyber Security Council said in April 2026 that more than 75 percent of cyber breaches begin with phishing emails or fraudulent messages. Security teams read that and want a human risk score for everyone who might open one. This guide is for CISOs and GRC leads who need to know what goes into a human risk score and what the business should do when it moves.
In short: A human risk score is a per-person number built from observed behavior, role and exposure. It earns its place only when a rising score triggers a defined response, such as a harder simulation, targeted training or a tighter control.
What a Human Risk Score Measures
The Council's figure of more than 75 percent, reported by Gulf Today, shows how often a breach starts in an inbox. It does not show which inboxes carry the most risk. An employee cyber risk score answers that second question by estimating how likely one person's next decision is to let an attacker in, and how much damage follows if it does.
The likelihood half comes from behavior. The damage half comes from role and access, so the accounts payable approver who can release a payment scores differently from a colleague with the same click history and no payment rights. Human risk scoring combines both halves and keeps them current. Verizon's 2026 Data Breach Investigations Report says the most frequent causes of breaches continue to heavily involve the human element.
For how scoring sits inside a wider program, and how that differs from annual training, read our comparison of human risk management and security awareness training. This guide stays on the mechanics of the score itself.
Inputs That Belong in the Score
Start with signals you can observe without guessing. Each one should trace back to an event, so that when a manager asks why a score moved, there is a real answer.
Simulation outcomes. Clicks, credential entry and attachment opens, weighted by how convincing the lure was.
Reporting behavior. Whether the person reports suspicious messages, and how quickly.
Repeat behavior. The same mistake across several campaigns, not a single slip.
Training activity. Completion, and how the person performs in later simulations.
Role and exposure. Access to payments, customer data, admin rights or executive calendars.
Difficulty matters because a click on an obvious lure and a click on a convincing one are different events. Reporting matters because a person who reports quickly protects the organization even after a mistake. That is why Fraus Whitebait tracks reporting rate next to click rate.
Leave out anything that reads as a personal judgment. Job grade, tenure and guesses about personality add noise and invite disputes. NIST SP 800-50 Rev. 1, published in September 2024, includes suggested metrics and evaluation methods to regularly improve and update a learning program, and it makes a useful test for every input: can you say what it measures and what you will do about it?
How to Measure Human Risk Over Time
A single score is a snapshot. To measure human risk in a way a board will trust, track movement by group and by role over months, not one organization-wide average.
Set a baseline first. Run a mixed set of scenarios across a quarter and record each person's starting position. Then watch three things: how many people report, how fast they report, and how often the same people repeat a mistake. A falling repeat rate in a high-access group says more than a falling overall click rate.
Keep the weights simple enough to explain in one sentence per input. If a CISO cannot tell the audit committee why one team scores higher than another, the number will be ignored. Our guide to security awareness KPIs for the board shows how to turn these measures into a one-page view.
What Should Happen When a Score Rises
A score on a dashboard changes nothing by itself. The value comes from a defined response when a score crosses a line, and the response should match the cause.
Repeated simulation failures. Move the person to scenarios matched to their role and set the next difficulty level.
Low reporting. Assign short training on how and why to report, then retest.
High exposure and a rising score. Escalate to the manager and consider a tighter control, such as an extra approval step on payment detail changes.
Behavior that points to a policy gap. Ask for policy acknowledgement on the rule the person has not seen.
Fraus Odin runs this loop with continuous per-employee scoring, role criticality weighting, individual threat profiles and automatic escalation. Its agentic AI recommends or assigns training, policies and controls, supervised or unsupervised. The aim is for the response to reach the person while the behavior is still recent.
Scoring in UAE and GCC Organizations
Regional context changes the design. Staff read and work in Arabic and English, so a simulation or training module in only one language partly measures comprehension rather than behavior. A score is fair only when everyone receives content they can read comfortably.
Decide early where the score data will live, because a score is personal data about an employee's behavior. Fraus can be hosted on UAE or GCC servers or deployed fully on-premise, and it is available in Arabic and English.
Agree who sees individual scores as well. A practical rule is to show named scores to the employee and their manager, and aggregate scores to the board. That keeps the conversation about support rather than blame.
Start With One Role Group
Go back to the accounts payable approver. Pick that group, list the five inputs above, write down the response for each threshold and run it for one quarter. By the end you will know whether the score moves for reasons you can explain to an auditor.
If you want to see scoring and escalation working across a whole workforce, Odin is where to begin.
Frequently Asked Questions
What is a human risk score?
A human risk score is a number for each employee that estimates how likely they are to make a decision that lets an attacker in, and how much harm it could cause. It combines observed behavior, such as simulation results and reporting, with role and access, and it updates as new behavior is recorded.
How do you calculate an employee risk score?
Choose a small set of observable inputs, such as simulation outcomes, reporting behavior, repeat behavior, training activity and role exposure. Weight each input, with more weight on convincing lures and on roles with payment or data access. Recalculate after every event, and keep each weight simple enough to explain to an auditor.
What are human risk scoring best practices?
Score only what you can observe, weight by role, and track reporting alongside clicks. Tie every threshold to a defined response, such as a matched simulation or targeted training. Show named scores only to the employee and manager, report aggregates to the board, and review the weights each quarter.
Most CISOs can show the board a training completion figure. Fewer can say which employees are most likely to be the way in next month, or whether last quarter's course changed anything they do at their desk. This post sets out human risk management vs security awareness training for CISOs in the UAE and the wider GCC, and shows when a team is ready to switch.
In short: Security awareness training teaches everyone the same material on a schedule. Human risk management measures each employee's behavior, scores their risk, and adjusts training and simulations to match. Make the move once you can act on individual data.
Human Risk Management vs Security Awareness Training at a Glance
Security awareness training is a program of courses, reminders and campaigns delivered to the whole workforce. NIST frames the goal in its guidance on building a cybersecurity and privacy learning program, which treats awareness, training and education as a life cycle that encourages behavior change and is measured and improved over time.
Regulators in the region expect this work. The UAE Information Assurance Regulation calls for an awareness and training program so that people understand the risks of their activities and can carry out their security responsibilities. For many GCC teams, that is where the program started, and a well-run one still earns its place.
Human risk management changes the unit of measure from the course to the person. It tracks what each employee clicks, reports, ignores and repeats, weights the result by what their role can reach, and then picks the response. Training is one response among several. Fraus builds this in Odin, with continuous per-employee risk scoring and individual threat profiles.
HRM vs SAT: What Changes in Practice
Teams that compare HRM vs SAT often expect a new tool. The bigger change is in the questions the program can answer. Four differences show up in a traditional security awareness vs human risk management comparison.
What is measured. A course program reports completion and quiz scores. A human risk program reports behavior over time, such as how often a person reports a suspicious message, how quickly, and whether the same mistake comes back.
Who gets what. A fixed program sends every person the same module. A risk-based program matches content and simulation difficulty to the person's role, history and exposure, so a payments clerk and a facilities coordinator are not trained on the same lure.
How often. An annual cycle is a calendar event. A continuous program responds to signals as they appear, and training can be assigned automatically when behavior shows a gap.
Who can act. Completion rates give a CISO little to escalate. Individual scores let the team see who needs attention, route it to a manager or an automatic response, and show the board a trend. The board KPI one-pager shows how to present it.
Why Annual Cycles Miss Current Lures
The case for measuring people starts with where breaches begin. The Verizon 2026 Data Breach Investigations Report found the human element present in 62% of breaches, up slightly from 60% the year before. Attackers still go through people, and they change the way they reach them.
The same report shows how quickly the channel moves. In phishing simulations, the median successful click rate for voice and text messaging was 40% higher than for email.
A module written for last year's email lure does not prepare someone for a text message from a supposed courier. A continuous program can introduce new channels and scenarios as they appear, and it can set the difficulty for each person. Fraus runs this through simulations in Arabic and English, so the lure arrives in the language the employee actually works in.
Matching content to each person only works if something tells you where each person stands. That is the job of the risk score, and it is also the first thing to test when deciding whether your team is ready.
Signs a GCC Team Is Ready
Readiness is less about budget than about data and ownership. A team is usually ready for human risk management when most of these are true.
You already record click, report and repeat behavior, even if only for simulations.
Completion is high, yet you cannot say which roles carry the most exposure.
Staff work in Arabic and English, and training and simulations need to match both.
Hosting is settled, whether on UAE or GCC servers or fully on-premise.
Someone owns acting on the scores, in security, HR or both.
If most of those are not yet true, begin with a baseline instead of a platform change. Keep delivering training, because it remains the response when a score shows a gap. In Fraus, Codex supplies the Arabic and English micro-learning, and dynamic human risk modeling supplies the continuous scoring that decides who gets it.
Where most of them hold, the move is mostly one of process. The courses you already run stay, and the schedule gives way to signals.
Start With One Role Group
Go back to the board question from the start of this post. Pick one high-exposure group, such as finance approvers, and measure it for a month: reporting rate, time to report and repeat behavior, alongside the simulation click rate. The automated phishing simulation guide explains what to keep running while you do.
At the end of the month you will know which people need a different response and which already behave well. Take that result to the board as your first per-employee risk report, then widen the program one group at a time.
Frequently Asked Questions
Does human risk management replace security awareness training?
No. Training stays in the program as one response. What changes is how it is chosen. Instead of every employee receiving the same course on the same date, scores and behavior decide who gets which training, how hard the simulations are and when. Courses become a tool inside the program rather than the program itself.
What does HRM measure that SAT does not?
SAT usually reports completion, quiz results and campaign click rates for groups. HRM adds per-person behavior over time, including reporting rate, time to report and repeated mistakes, weighted by role criticality. That lets a CISO compare people and groups by risk and see whether a response changed behavior.
Does this still support UAE IA awareness expectations?
The UAE IA Regulation asks entities to implement an awareness and training program. A human risk program keeps training in place and adds measurement and targeting. Fraus holds UAE IA compliance, and Codex includes compliance mapping for its training content.
Who should own human risk scores inside the organization?
Security usually owns the scores and the model. HR, line managers and the compliance team need access to the part that concerns them, such as policy acknowledgement or repeat incidents. Agree in advance what triggers escalation, who is told and which actions happen automatically within set boundaries.
In April 2026 the UAE Cyber Security Council told the Emirates News Agency that more than 75 percent of cyber breaches begin with phishing emails. For a CISO or security awareness manager, that figure turns into a practical question at budget time: which phishing simulation UAE teams can run in the languages their staff read, on servers that fit their data rules. This guide is for the person who has to choose one.
In short: Choose a phishing simulation that runs in Arabic and English, can be hosted in the UAE or on-premise, covers MFA bypass, QR code and credential harvesting scenarios, and reports how many people report a lure, not only how many click.
Why Generic Campaigns Fall Short
Verizon's 2026 Data Breach Investigations Report found the human element in 62% of breaches. Its executive summary puts phishing as the initial access vector in 16% of all breaches, 20% in finance and insurance, 20% in public administration and 22% in educational services.
Those sectors cover many UAE buyers, and they share a problem. Staff in the UAE read and write in Arabic and English, often within the same day, so a template library in one language tests only part of the workforce. An accounts payable clerk and a receptionist also face different lures, and a campaign built for one tells you little about the other.
That is the lens to apply when you read a vendor's feature list.
What a Phishing Simulation UAE Buyer Should Check
Five questions separate a platform built for this region from one that was translated for it.
Languages. Arabic and English templates, with the same scenarios available in both.
Hosting. UAE or GCC servers, or a fully on-premise deployment, to match your data residency rules.
Scenarios. MFA bypass, QR code and credential harvesting scenarios, beyond a plain link in an email.
Targeting. Campaigns matched to each person's role and behavior instead of one send to everyone.
Reporting. Reporting rate tracked next to click rate.
Fraus built Whitebait around these points. It offers AI-recommended campaigns, Arabic and English templates, MFA bypass, QR code and credential harvesting scenarios, UAE or GCC hosting or on-premise deployment, and reporting rate alongside click rate.
The scenario list deserves a closer look, because attackers do not stay in the inbox.
Scenarios That Match How Attacks Arrive
The same Verizon report found that in phishing simulations, the median success rate for mobile-centric vectors such as voice and text messaging is 40% higher than for email. The UAE Cyber Security Council's April 2026 advice to the public points the same way: avoid scanning QR codes in public or untrusted places, and enable multi-factor authentication.
MFA bypass. A lure that sends someone to a fake sign-in page and captures the one-time code tests whether people treat a second factor as proof that a page is genuine. A program that only simulates password theft never asks that question.
QR codes. A QR code on a poster or inside a PDF moves the decision to a phone, away from the mail gateway and away from the habits staff built around email links.
Credential harvesting. This stays the baseline scenario. It works best when the template looks like a system the person uses every day, written in the language they use it in.
Which of these you run, and how often, depends on what each person has to defend and on what your regulator expects.
What UAE Regulation Says About Awareness
The UAE Information Assurance Regulation (version 1.1, March 2020), published on the TDRA website, applies to all UAE government entities and to other entities designated as critical, and it highly recommends that all other entities in the UAE adopt it voluntarily, as applicable. Its Awareness and Training control family states that an awareness and training program shall be implemented to inform entities of the risks associated with their activities, and that personnel assigned information security responsibilities are trained to be competent in them.
Other emirate-level and sector frameworks may apply to your organization as well. Check the wording of each against your own entity before you set a schedule, and ask every vendor to show how its reports map to the controls you are audited on. Ask for its own credentials too: Fraus holds ISO/IEC 27001 certification and UAE IA compliance, and is aligned with the NIST Cybersecurity Framework.
An auditor will ask for evidence, which brings the question to the report itself.
What the Report Should Show
A click rate alone tells you who fell for a lure and leaves out who noticed it. A useful report carries these measures for every campaign:
Click rate and reporting rate, side by side.
Time to report, from delivery to the first report.
Repeat behavior: who clicked again across campaigns.
Results by role, department and language.
Results by scenario: email, QR code, MFA bypass and credential harvesting.
Cadence follows the same logic. A calendar of campaigns across the year, with scenario and difficulty matched to each person, produces enough data points to see repeat behavior, which a single annual test cannot. If you want that schedule to run inside guardrails you set once, read how automated phishing simulation works.
Run a 30-Day Check Before You Commit
Go back to the awareness manager choosing a platform before the next budget meeting. Ask each shortlisted vendor to run a 30-day pilot against one department, with one Arabic template, one English template, one QR code scenario and one MFA bypass scenario.
At the end, check whether the report shows reporting rate next to click rate, whether the data stayed where your rules require, and whether the Arabic templates read the way your staff write. Then send the people who clicked into short follow-up training, such as Codex, and compare the next campaign with the first.
Frequently Asked Questions
How often should organizations run phishing simulations?
Run them continuously through the year instead of once. A calendar that varies scenario, channel and difficulty gives you repeat-behavior data, and a per-person schedule keeps each campaign at the right level for that role. Automated platforms can hold that schedule inside guardrails you set once, so the program does not depend on someone remembering to launch it.
What should a phishing simulation report include?
Show click rate and reporting rate for the same campaign, time to report, repeat behavior, and results split by role, department, language and scenario. Those figures let a CISO see whether people are noticing lures sooner and whether the same individuals keep clicking, which a single click percentage hides.
Which regulations require cybersecurity training for Dubai enterprises?
The UAE Information Assurance Regulation applies to government entities and entities designated as critical, and its Awareness and Training family calls for an awareness and training program. Other entities are encouraged to adopt it. Your compliance team can confirm which emirate-level or sector frameworks also apply to you.
A director who has read the 2026 Verizon Data Breach Investigations Report knows the human element was present in 62% of breaches. The director's next question is what the company's own number is and whether it is falling. This post is for GCC security leaders who need security awareness KPIs for the board that answer that on a single page.
In short: Lead with four measures instead of the completion rate: exposure trend, reporting rate, time to report and the repeat-risk cohort. Show each as a trend by role group, keep names out of the pack, and keep completion as one line of compliance evidence.
Why Completion Rates Stop Answering the Question
Completion is the easiest number an awareness program can produce. It shows the program ran, which auditors and regulators will ask about, and it says little about whether people handle the next suspicious message better than the last. A director reading it has no way to tell.
Directors tend to ask three things, in some order: is human risk going down, where does it sit in the organization, and how quickly do we react when someone is targeted. Four measures answer those, and each has to make sense to a director reading the page without you in the room.
Four Security Awareness KPIs for the Board
These four fit on one page, and each can be defined in a sentence.
Exposure trend is the median per-employee risk score and the share of employees in the highest risk band, by month.
Reporting rate is the share of suspicious messages that employees report, shown next to the click rate and split by channel.
Time to report is the median number of minutes from delivery to the first report.
The repeat-risk cohort is the count of employees who show risky behavior in consecutive periods after follow-up, by function.
Completion stays on the page as a single compliance line beneath them. The first and last of the four need a score for each person rather than each campaign, so they come first.
Exposure Trend and the Repeat-Risk Cohort
An organization-wide average hides the places a director cares about. A score that holds steady overall can still be climbing in accounts payable, where one successful message can move money. Exposure therefore starts at the individual, weighted by role, and rolls up to the page afterward.
Fraus Odin scores every employee continuously from behavioral signals and weights each score by role criticality. Grouped by function, those per-person scores give the page its trend line and its share of employees in the highest risk band.
The repeat-risk cohort reads the same data from the other side, as the group that keeps showing risky behavior after follow-up. Report its size, the functions it sits in and what happened next. When an individual's risk reaches critical levels, Odin notifies the relevant stakeholders automatically and can recommend or assign training, policies and controls, so the page shows actions taken as well as a count.
Reporting Rate and Time to Report
The other two measures start when a suspicious message lands. Click rate alone gives half of that picture. NIST's work on its Phish Scale notes that click rates analyzed on their own can create a false sense of security, because a low rate may come from emails that were too easy, lacked relevant context or resembled an earlier exercise.
So record each simulation's difficulty next to its click rate, and put the reporting rate beside both. That record matters more once each simulation is matched to the person's role, behavior and difficulty level, as our post on automated phishing simulation describes.
Channel matters as much as difficulty. In the 2026 Verizon DBIR, the median click rate in simulated phishing campaigns using voice and text lures was 40% higher than for email. A pack that reports email results alone leaves out the channels where simulations succeed more often, so split click and reporting rates by channel.
Reporting earns its own line because it does not simply mirror clicking. As SC Media reported from Verizon's 2024 DBIR, 20% of users reported phishing in simulation engagements, and 11% of the users who clicked the email reported it as well. The overall reporting rate had been growing for several years, so treat 20% as a reference point and make your own trend the headline.
Speed is the other half of reporting. The same DBIR put the median time for users to fall for phishing emails at under 60 seconds. Measure how long the first report takes to arrive, because that figure tells the security team how much of a head start it gets.
Friction affects both numbers. The 2026 report advises making it as painless as possible for people to notify you when they have fallen for something. Fraus Whitebait tracks reporting rate next to click rate, and the Fraus Teams App lets employees report a suspicious message from inside Microsoft Teams with a single tap.
Building the One-Page View for GCC Boards
Four numbers help only if directors can read them. Give each KPI the same four things: this quarter's value, the last four quarters as a trend, a target and one sentence on what you did about it. Use the same layout at every meeting, and cut by role group instead of by campaign.
Keep names out of the pack. Directors need cohorts and functions, and individual scores stay with the program team. Where policy keeps employee-level data in the country, the hosting model matters too, and Fraus can be hosted on UAE or GCC servers or deployed fully on-premise.
Language is one more cut that belongs on the page. Where employees work in both Arabic and English, split the reporting rate by language group. A gap between the two is a content problem to fix before it is a people problem.
The same page serves the regulator conversation. Saudi Arabia's Essential Cybersecurity Controls (ECC-2:2024) apply to government entities and to private-sector owners, operators and hosts of critical national infrastructure. They ask for an awareness program delivered through multiple channels (1-10-1), implemented (1-10-2) and periodically reviewed (1-10-5). Control 1-2-3 calls for a cybersecurity supervisory committee formed on the instruction of the entity's Authorized Official, a natural audience for this page.
In the UAE, the UAE IA Regulation, issued by the Telecommunications and Digital Government Regulatory Authority, sets management and technical information security controls for the entities it covers. Ask your compliance lead which controls your four KPIs and your completion line support, and label the page that way.
Take One Page to the Next Board Meeting
The director who asked for the human number does not need a longer report. Pick the four definitions this week, pull last quarter's data against them and draft the page with a target and one action beside each number.
If a number cannot be produced from your current tools, record that as the first gap to close and say so in the pack. Directors can act on a named gap, but not on an estimate presented as a measurement.
Frequently Asked Questions
What cybersecurity metrics should I report to my board?
Report outcomes on one page and keep activity counts as supporting evidence. For awareness, that means exposure trend, reporting rate next to click rate, time to report and the repeat-risk cohort, each shown as a trend by role group, with completion as a single compliance line. Other domains, such as vulnerabilities or suppliers, take their own lines in the same layout.
How do you present cybersecurity risks to the board?
Use plain language and the same layout every time: current value, trend, target and the action you took. Start from the business consequence, such as a fraudulent payment or downtime, and describe what a control does instead of naming the product. State risks as they are, without playing them down or overstating what your controls achieve.
How can I communicate cybersecurity ROI to the board?
Show movement against targets you set at the start, and tie each target to something the board already tracks. Falling exposure in finance roles and faster first reports are both measurable. Avoid savings figures you cannot trace to your own data, because directors will ask where the number came from.
.svg)
.svg)
.svg)
.svg)
.svg)
.png)
.png)
.png)
.png)
.png)
