.svg)
.svg)
.svg)
.svg)
.svg)
In April 2026 the UAE Cyber Security Council said more than 75 percent of cyber breaches begin with phishing emails, and that prompt reporting helps response teams prevent serious incidents. This post is for UAE and GCC security leaders deciding whether awareness work lowers the chance of a real incident. It explains how phishing simulations reduce risk when they rehearse the attacks real adversaries run, and which changes in behavior to measure.
In short: Awareness tells people what phishing is. Risk falls when simulations rehearse the attacks adversaries run against the executives, finance staff and IT administrators they would target, and when you measure reporting, verification and time to report, not clicks alone.
Where Awareness Ends and Rehearsal Begins
Awareness tells people what phishing looks like: an unfamiliar sender, an urgent tone, a link that does not match. That knowledge is the foundation of every program. A real attack, though, rarely arrives as a generic message. It arrives addressed to one person, about something that person is working on, and sometimes after the attacker has already made contact.
The Verizon 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, shows how much of this sits with people. The human element was present in 62% of breaches. Phishing was the entry point in 16%, and pretexting, where a trusted relationship is built through a concocted scenario, reached 6% and has become a more common way into ransomware and extortion attacks.
Pretexting is the number that matters most here, because it describes what a generic program cannot rehearse: the story. A single annual module and a stock fake-parcel email teach the vocabulary. They cannot practice the moment a finance lead receives a plausible request from a plausible colleague.
NIST makes a related point about measurement. Its Phish Scale rates a lure's difficulty against a specific target audience, and notes that low click rates analyzed on their own can create a false sense of security. The same lure can be easy for one team and hard for another, so the exercise has to be matched to the people receiving it. To match it, you first need to see how attackers do their homework.
How Attackers Research Employees Before Phishing Them
They start with open sources. In a January 2023 alert, the UK National Cyber Security Centre described two groups, based in Russia and Iran, that used social media and professional networking platforms to find hooks that would engage a target, and mapped the target's real-world social and professional contacts.
From there they built the pretext. The groups created fake profiles posing as respected experts, registered webmail accounts that impersonated known contacts, and set up look-alike domains of legitimate organizations. They opened with benign contact on a topic of interest, and the correspondence could run for an extended period before a link to a supposed document or sign-in page appeared.
The same ingredients appear in Gulf warnings. In October 2025 the UAE Government Empowerment Department warned that attackers combine AI, urgency and impersonation of official authorities, and use deepfake technology to deceive employees and mimic voices.
Attackers spend that effort where it pays. An executive's public profile supplies a voice worth borrowing, a finance lead can release payments, and an IT administrator holds privileged access. Much of what the attacker used is public, which means a simulation can be built from the same material.
How Phishing Simulations Reduce Risk at Each Step
A simulation reduces risk when it rehearses each link of that chain against the person who would face it. Each stage asks something specific of a well-built exercise:
- Reconnaissance. Build the scenario from what is publicly known about the target: role, projects, events, contacts and the language they work in.
- Pretext. Use a story tied to that person's work, such as a conference follow-up, a vendor query or a request from a senior colleague.
- Lure. Deliver it through the channel an attacker would pick: email, text, a call, a QR code or a meeting link.
- The human decision. Record what the person does: ignore it, report it, verify it through another channel, click, or enter credentials.
- Escalation. If the first attempt is ignored or answered, follow up the way a persistent attacker would, with a second message or a different channel.
Escalation is the stage generic programs tend to skip, and real campaigns rarely stop at one message. The NCSC described actors who, after a successful sign-in, read the mailbox, set up forwarding rules and sent further phishing to the victim's contacts. A sequence can rehearse that pressure. It also gives people practice in the habit the UAE Government Empowerment Department recommends for suspicious calls: hang up, look up the official number and call back to verify.
This is the design behind Fraus Blackbait, which runs OSINT reconnaissance on selected targets and escalates attacks autonomously, so the rehearsal follows the chain from research to follow-up instead of a fixed template. The open question is who should face it first.
Who Should Get the Most Realistic Simulations
Start with the people whose compromise costs the most: executives and their assistants, finance and payments staff, and IT administrators with privileged access. Give them scenarios built from their own public footprint and sequences that escalate. A payment-change request is only one of the lures finance staff face, and it has its own breakdown in Invoice Fraud in UAE Construction.
Everyone else still benefits from simulations matched to their role, at lower intensity and in the language they work in, whether Arabic or English. Fraus Odin weights each person's risk by role criticality and behavior, which shows where the next realistic simulation should go.
Simulations built from public information about real people need guardrails first. Agree the scope with HR and legal, keep private social accounts out, confirm how the collected data is handled, and decide in advance how people who click are supported. Reporting only works in a culture where it feels safe.
What Behavior Change Lowers Real-World Risk
Clicks are the easiest number to collect and the least complete. The Council points to a different behavior, prompt reporting. A reported lure gives the response team a head start on every other mailbox that received it. Track four things for each role group:
- Reporting rate. The share of targeted people who report the lure, shown next to the click rate.
- Time to report. Minutes from delivery to report, since a late report leaves the attacker time to work.
- Verification. Whether people confirm an unusual request through a second channel before acting.
- Repeat behavior. Whether the same people improve across successive, harder scenarios.
Trend these per group rather than company-wide. When the finance team's time to report falls across escalating scenarios, the rehearsal is working. The board-level view of these numbers is laid out in Security Awareness KPIs for the Board on One Page.
Pick One Group and Build Their Chain
Go back to the Council's two points: most breaches begin with a message, and prompt reporting helps stop serious incidents. Your next step can be small. Choose one high-exposure group, such as finance or the executive office, and write down the attack chain an adversary could build from their public profile. Agree the guardrails, run one escalating scenario, then record who reported, how fast, and who verified. That baseline tells you where to rehearse next.
Frequently Asked Questions
Do phishing simulations reduce real-world risk?
Yes, when they rehearse the attacks adversaries actually run and are measured by behavior. Role-matched, realistic simulations build the habits that interrupt an attack: reporting quickly and verifying unusual requests. The UAE Cyber Security Council links prompt reporting to response teams preventing serious incidents. Track reporting and time to report next to clicks to see the effect in your own data.
What makes a phishing simulation realistic?
It fits the target. The story matches the person's work, the sender is plausible, the channel and language are the ones an attacker would use, and the exercise can follow up if the first message is ignored. NIST rates lure difficulty against a specific audience, so judge realism by how well the scenario fits the people receiving it.
Which employees should get the most realistic simulations?
Executives, finance and payments staff, and IT administrators with privileged access, because compromising them gives an attacker authority, money or access. Prioritize by role criticality and public exposure, then give everyone else simulations matched to their role at a lower intensity.
How do attackers research employees before phishing them?
They use open sources such as company websites, social media and professional networking platforms. The UK National Cyber Security Centre described groups that used these to find hooks, map a target's contacts and build fake personas before sending a lure. Limiting what senior staff publish helps, and simulations built from the same public material show how convincing the result is.
.png)
.png)
.png)
