Stay up-to-date with the latest insights, case studies, and expert articles on human risk management, cybersecurity, and the power of adaptive phishing simulations. Learn how Fraus can help your team stay secure and informed.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Invoice fraud in UAE construction often arrives as an ordinary supplier email asking to update bank details shortly before a payment falls due. This post is for finance controllers and CISOs at contractors and developers who want to see how the scam works and how to test the step where it succeeds.
In short: Criminals read genuine supplier email, then ask the paying team to send payments to a new account. Abu Dhabi Police warn against paying on an email alone. Confirm every change by phone on a number on file, and use simulation to check that teams do.
How the Bank-Detail Change Attack Works
On 8 October 2026, Abu Dhabi Police warned companies about fake emails that impersonate legitimate beneficiaries and business partners and ask them to change bank account details. Payments and outstanding amounts then go to the new account. Police said the scam often goes unnoticed until after the money has been transferred, as Gulf News reported.
Police added that fraudsters use genuine business correspondence to make the change request look legitimate. The Gulf News explainer published with the warning sets out the pattern in four stages.
Criminals compromise a vendor's or employee's email account, or register a fake domain that closely resembles a real one.
They read the correspondence to learn about invoices, payment dates and who deals with whom.
Shortly before a payment is due, they ask for it to go to a new account, sometimes citing a genuine invoice number or official-looking documents.
The fraud may surface only when the real supplier chases the unpaid invoice.
The explainer also lists warning signs, including urgency, a slightly altered sender address, a change with no prior notice, avoidance of phone verification and a bank in a different country from the supplier's usual location.
Construction has seen the same pattern elsewhere. The Australian Cyber Security Centre described scammers who pose as a legitimate business, write to its customers and ask them to change the bank details used for future invoice payments. It noted that the fraud can go unnoticed for weeks or months, until the construction company follows up on missing payments.
Invoice Fraud in UAE Construction Chains
A UAE project pays through a chain. A developer pays a main contractor, the contractor pays subcontractors and suppliers, and consultants certify the work along the way. Each link holds a mailbox that a criminal could read, and no link can see how well the others protect theirs.
Your controls do not cover their inbox. In 2015, Middle East Construction News reported that fraudsters targeted a customer of Dubai's Construction Machinery Centre (CMC). The customer's private email account was allegedly broken into, and criminals posing as a CMC representative asked for a genuine bill to go to their account. CMC's own networks were not breached. The customer started the transfer before the attempt was identified and blocked.
Two parties, one missing payment. A Dubai case reported by Gulf News in 2025 began as a Dh23,000 payment dispute. One company said it had paid and held transfer records, and the other said it never received the money. Investigators found that an intercepted and altered email exchange had changed the payee account.
The UAE Cyber Security Council says more than 75% of cyber breaches begin with phishing emails or fraudulent messages, according to Gulf Today. A bank-detail change request is one of those messages, written to look like routine supplier correspondence.
Controls That Close the Gap
The decision that matters is small and human. Someone in accounts payable, procurement or a project office decides whether an emailed request is enough to change a supplier's bank details. Criminals send the request shortly before a payment is due, so it arrives with a deadline attached.
Abu Dhabi Police urge companies not to transfer money based solely on emails requesting changes to bank account details, and to strengthen internal verification procedures. Their advice and the protection steps in the Gulf News explainer include the following.
Verify every bank-detail change by phone, using a number already on record rather than one in the email.
Require approval from more than one authorized employee.
Strengthen email security with DMARC, DKIM and SPF.
If fraud is suspected, contact your bank at once and ask whether the transaction can be recalled.
Report it without delay through Abu Dhabi Police's Aman service on 8002626, by text to 2828 or at aman@adpolice.gov.ae.
Train the employees who handle finances and correspondence.
Add one rule that fits a project chain. Take the phone number from the contract or from an earlier verified payment, and record who called, which number they used and when.
Test the Change Step With Simulation
Written procedures only hold when people follow them under deadline. A simulated bank-detail change request shows what a finance or project team does when one arrives, before a criminal sends the real one.
Fraus Whitebait runs phishing simulations with Arabic and English templates, so the request can arrive in the language your suppliers use. Dolus AI Studio turns an email screenshot or a prompt into an editable template, so a scenario can match the tone of your own supplier emails.
Measure the response. Whitebait tracks reporting rate next to click rate. For this scenario the reporting rate is the number to watch, because a report is how the rest of the company learns about a suspicious request.
Weight the roles that hold the keys.Odin scores human risk for each person and weights it by role criticality, so staff who can change supplier details or release payments count for more than their colleagues. A repeated miss escalates automatically instead of waiting for the next review.
Matching each person's role and difficulty level, and running the scenario on a continuous cadence, keeps the change step in front of the people who handle it. The Fraus page for construction and development shows how this applies across the project chain, and the post on automated phishing simulation explains how a program runs through the year.
Run a Check on Your Last Ten Changes
Start with your own records. Pull the last ten supplier bank-detail changes and look for the call, the number used, the second approval and the date. Any gap shows where the process relies on one person's judgment.
Then pick a pilot group such as accounts payable and project accounts, run a simulated change request, and review the reporting rate with the head of finance. If you want to see this scenario run for your own teams, talk to Fraus about a demo.
Frequently Asked Questions
How do fraudsters redirect supplier payments by email?
They take over or imitate a supplier's or employee's mailbox, read the invoice conversation, and send a message shortly before payment is due asking for a new bank account. The message may quote a genuine invoice number. The fraud may surface only when the real supplier chases the unpaid invoice, sometimes weeks or months later.
How do we verify a supplier's change of bank details?
Phone the supplier on a number you already hold, never one from the request, and require more than one authorized employee to approve the change. Abu Dhabi Police warn against transferring money based solely on an email that asks for new bank details. Take the number from the contract or an earlier verified payment, and record who called and when.
Who bears the loss when a client pays a fraudulent invoice?
There is no single answer, because it depends on the contract and the facts of the case, so involve legal counsel early. In a Dubai case reported in 2025, one company said it had paid and the other said it had not been paid. The dispute went to Dubai's Centre for Amicable Settlement of Disputes and was referred to cybercrime authorities, and the companies agreed to settle.
What should we do if we have already paid a fraudulent invoice?
Contact your bank immediately and ask whether the transaction can be recalled, then report it without delay. In Abu Dhabi you can use the Aman service on 8002626, by text to 2828 or at aman@adpolice.gov.ae. Do not reply to the message or send further money, and confirm the correct details with the genuine supplier by phone.
A security awareness manager on a lean team cannot hand-build a different phishing simulation for every employee, so most programs settle for one campaign to everyone each quarter. Automated phishing simulation closes that gap when the automation covers the right things. This post is for the people who own the program in a GCC organization and decide what to automate and what to keep.
In short: Automation should mean AI that picks each employee's next simulation all year from their role, behavior and difficulty level, while your team keeps policy, consent, escalation and review. A lean GCC team can then run a continuous program in Arabic and English.
What Automated Phishing Simulation Should Mean
A scheduler automates the calendar. It sends the same template to the same group on a fixed date and reports the result afterward. That saves effort, yet every person still gets the same difficulty on the same day, whatever their role or history.
Automation worth the name also takes over the decisions about who is tested next, which lure fits their work, how hard it should be and what happens after they click or report. A lean team never has time to make those decisions for every person, and an AI can make them continuously.
NIST's Phish Scale shows why those decisions matter. It rates how hard a phishing email is for a person to detect, based on the cues in the email and how well its premise fits the recipient's work and responsibilities (NIST phishing research). The same email can be easy for one group and hard for another. That is the reason to automate the choosing as well as the sending.
Cadence matters too. Verizon's 2026 Data Breach Investigations Report found the human element present in 62% of breaches and phishing the initial access vector in 16%, the same share as the year before (Verizon 2026 DBIR). In phishing simulations, it found the median successful click rate for mobile-centric vectors such as voice and text to be 40% higher than for email.
Employees meet lures on their phones as well as in the inbox. A once-a-quarter send samples that exposure a few times a year, and a program that runs all year keeps sampling it.
What the AI Runs All Year
Graybait, our automated phishing simulation, works from a simple split. You set the policy and guardrails once, and agentic AI picks each employee's next simulation all year from their Human Risk Profile. In practice, that covers the following for every person.
Which simulation each person receives next, picked from their Human Risk Profile.
A new pick for every employee throughout the year, instead of one campaign each quarter.
Every pick made inside the policy and guardrails your team set once.
One policy governs the whole program, and the AI applies it person by person. A new finance hire and a long-serving operations engineer each get a simulation picked from their own profile, and neither waits for a calendar date. That is how automation and personalization work together.
What Your Security Team Keeps
Automation changes the team's job from sending campaigns to owning the rules. Four of those rules stay with people.
Guardrails. Write down who is in scope, how difficult a lure may become, how often one person can be tested and which themes are off limits. Themes that exploit grief, illness, pay cuts or job losses harm trust in the program and should be ruled out. The AI works inside those limits.
Consent. Tell employees that the program exists, what it measures and who sees individual results. Put this in the acceptable-use policy and in onboarding, and agree the wording with HR and legal against your data protection obligations. Employees know the program exists, and each lure still arrives unannounced.
Escalation.Odin, our human risk management platform, scores each person's risk continuously, escalates automatically and can recommend or assign training, supervised or unsupervised. Choose the mode, starting supervised and moving to unsupervised once you trust the pattern, and write the escalation ladder into the program policy. Decide now that a simulation result is a coaching signal and never a disciplinary action on its own.
Review. Meet monthly to check the lure set against what employees are reporting, the spread of difficulty, any exemptions and results by role group. Keep short notes on what changed and why. Monthly is a workable rhythm for a lean team, and the notes become your record when an auditor or the board asks how the program is run.
How This Works for GCC Organizations
Teams in the GCC often work across Arabic and English, and a lure in the wrong language tests language comfort as much as judgment. A simulation should reach each person in the language they work in, with themes that match the region.
Local threats set those themes. Earlier this year the UAE Cyber Security Council, with Emirates Post Group and the Darb platform, warned of a surge in online fraud through SMS, WhatsApp and email, using suspicious links and fake discounts (Gulf News). The Council has also advised the public not to scan QR codes in public or untrusted locations and to report suspicious messages (Gulf News).
Reporting is the behavior to build. Review your lure set against these themes each month, ask employees to report what they see, and watch how quickly the first report arrives.
Fraus is built in Dubai and runs in Arabic and English, and Whitebait, our phishing simulation, includes Arabic and English templates and QR code scenarios. We can host on UAE or GCC servers or deploy fully on-premise. Per-person click and report histories are sensitive data about your own staff, so ask every platform you assess where that data sits and whether it can run inside your environment.
Regulators. In Saudi Arabia, the NCA's Essential Cybersecurity Controls (ECC-2:2024) apply to government entities and to private sector owners, operators and hosts of critical national infrastructure (NCA ECC). Control 1-10-3 requires the awareness program to cover the most important and latest cyber risks, with secure handling of email, especially phishing emails, among the topics. Control 1-10-5 requires the program's implementation to be periodically reviewed and sets no frequency.
A program that runs all year gives you live material for control 1-10-3 and a record of results and changes for control 1-10-5. If another framework applies to you, read its awareness requirements the same way.
Measure What Changes
A lean team needs a short list of measures that show behavior moving.
Reporting rate, read alongside click rate.
Time to the first report after a simulation lands.
Repeat behavior, meaning who clicks again after coaching and who stops.
Click rate read against the difficulty of the lure.
Share of employees who have received a simulation this quarter.
Click rate alone moves with the lure, and NIST built the Phish Scale to give program staff context for it. Present trends by role group and keep individual results inside the program team, where coaching happens.
Write the Policy First
Before you assess any platform, draft a one-page policy covering scope, difficulty ceiling, test frequency per person, off-limits themes, the escalation ladder and the owner of the monthly review. Automation then has something to enforce. Graybait takes that policy once and runs the program from there, all year.
Frequently Asked Questions
How does automation work alongside personalization?
Your team writes the policy once, covering scope, limits, consent and escalation. The AI applies it to every employee and chooses each person's next simulation from their Human Risk Profile. The program runs automatically, and each person still receives a simulation matched to their role and behavior. You edit the policy when your risks change, not each campaign.
Does the AI keep its simulations up to date?
The AI picks each person's next simulation from their Human Risk Profile throughout the year, rather than from a schedule fixed months earlier. Your team keeps the lure set current with what employees report and what authorities warn about. Dolus AI Studio turns an email screenshot or a prompt into an editable phishing simulation template, so a message reported last week can become a template for the next round.
Are AI-powered simulations more effective?
They fit each person, and fit is what makes a simulation worth running. An AI-powered program matches each simulation to the employee's role, behavior and difficulty level, in the language they work in, which a lean team cannot do by hand for a whole workforce. Judge it on your own reporting rate, time to report and repeat clicks, read against lure difficulty.
Can automated phishing simulation run on our own servers?
Yes. Fraus can be hosted on UAE or GCC servers or deployed fully on-premise, so individual risk data stays where your policy requires. It is available in Arabic and English, holds ISO/IEC 27001 certification and UAE Information Assurance (UAE IA) compliance, and is aligned with the NIST Cybersecurity Framework.
An email asking an accounts payable clerk to confirm a supplier's new bank details the day before a payment run is a different test from the same email sent to someone in facilities. The words are identical. The odds of spotting it are not.
This post is for security awareness managers and CISOs in the UAE and wider GCC who send one template to the whole organization and want to know what an adaptive phishing simulation does differently, and how to judge its results.
In short: An adaptive phishing simulation matches each person's lure to their role, history, language and proven difficulty level, raises the bar for strong performers, supports those who struggle, and reads every result against how hard the email was.
What Adaptive Phishing Simulation Means
A fixed campaign picks one template, sends it to everyone on one date and reports one click rate. It is easy to run, and it answers a narrow question: how did this email perform against this crowd?
An adaptive program asks what the next simulation should be for each person. Role decides which story is believable. Behavior history shows what the person has clicked, reported or ignored before. Language decides whether the message reads as native. The difficulty level records how hard an email they have already handled.
Over a year the gap widens. Strong performers keep meeting emails worth their attention instead of coasting through easy ones, and people who struggle get lures they can learn from instead of the same failure on repeat. Who or what sends each email is a separate question, covered in Automated Phishing Simulation: What Runs, What You Keep. The rest of this post is about how each email is chosen.
How Difficulty Is Calibrated
Adaptation only works if difficulty is measured the same way each time. A well-documented public method comes from NIST. Its Phish Scale rates how hard a phishing email is to detect from two inputs: the cues in the message, and how well its premise fits the audience.
Cues are the features that should tip a reader off or push them to click. NIST's user guide groups them into errors, technical indicators such as look-alike domains, visual presentation, language and content such as urgency, and common tactics such as impersonating a trusted sender. Between 1 and 8 cues counts as few, 9 to 14 as some, and 15 or more as many. Fewer cues make a harder email.
Premise alignment asks how closely the story matches the recipient's work. Someone who knows the audience scores four elements: whether the email mimics a workplace process, has workplace relevance, lines up with other situations or events, including ones outside work, and raises concern about the consequences of not clicking. A fifth element, prior training or warnings on this kind of lure, is subtracted. Strong alignment makes an email harder.
Combine the two and an email with few cues and strong alignment is rated very difficult, while one with many cues and weak alignment is the least difficult. Because the scoring depends on the audience, the same email can earn a different rating for finance than for facilities. That is the case for adapting, built into the rating itself.
NIST's own results show how much it matters. NIST ran ten workplace exercises over more than five years, and five of them show the spread. A safety-requirements email rated very difficult drew clicks from 49.3% of recipients, and an unpaid-invoice email, also very difficult, drew 20.5%. A voicemail lure rated moderately difficult drew 11.6%, a security-token email 8.7%, and a software-update email rated moderately to least difficult 3.2% (Steves, Greene and Theofanos, Journal of Cybersecurity).
The authors note that premise alignment appeared to influence clicks more than the number of cues. An email with more mistakes but a premise that fits the work can draw more clicks than a cleaner one, so calibration has to look at the audience as well as the message. A rung on the ladder is simply a difficulty level with a person standing on it.
How the Ladder Moves Up and Down
Each person starts on a rung set by their role and earlier results, and the next simulation is drawn from that rung. What matters is the rule for moving, and there are two directions.
Up. When someone reports a simulation at their level, the next one comes from a higher rung: fewer cues, a premise closer to their real work, or a different channel such as SMS or a QR code. The reward for doing well is a better test.
Down. When someone clicks, the next simulation steps back to a level they can learn from, and the miss triggers short training on the cue they overlooked. Failing a very difficult email tells you something different from failing an obvious one, and the ladder treats the two differently.
Four rules keep the ladder honest. The last one is easy to skip, and it decides whether the results mean anything.
Move one rung at a time, so a single result never swings difficulty sharply.
Count a report as the strongest pass, stronger than simply not clicking.
Hold the rung when the evidence is thin, such as after one result or a long absence.
Log the difficulty of every send, so results stay comparable months later.
Role, Channel and Language
Role sets the premise. A supplier bank-detail change fits finance, a shared-document request fits a project team, and a student-record query fits a registrar. The same cue count rates differently for each group, because the story is believable to one and irrelevant to the others.
Channel follows the threat in your market. In February 2026 the UAE Cyber Security Council reported that scam messages had risen by about 35% over the previous year, with impersonation of government entities and trusted companies and SMS-based fraud among the forms it warned about (Gulf News). An adaptive program reflects that with government-service and bank-verification premises, delivered by SMS or QR code where staff are exposed that way.
Language is where a single template does worst. An employee who works in Arabic all day and receives an English-only simulation is tested on a message they would rarely meet in that form, so the result tells you little. People who read both can receive either, and which one they respond to becomes useful data.
Whitebait, the Fraus phishing simulation product, provides Arabic and English templates and tracks reporting rate next to click rate, so each person can be tested in the language they actually work in.
Reading Results Against Difficulty
Adaptation changes how you report. If one person received a very difficult email and another an obvious one, an average click rate blends two different tests. NIST's guide says click and reporting rates alone give a single point of insight, and difficulty supplies the context: very difficult emails may reasonably draw high click rates, while many clicks on a least difficult email point to an audience that needs additional training.
In practice, report results per rung rather than per campaign, show the reporting rate beside the click rate, and watch the trend. A cohort that clicks 20% on very difficult emails while reporting more of them each quarter is improving, even though its headline number looks worse than a cohort clicking 3% on easy ones. Security Awareness KPIs for the Board on One Page shows how to summarize this for executives.
Start With One Role Group
Go back to the accounts payable clerk. A bank-detail lure timed to the payment run is far harder for that person to dismiss than for anyone else in the company, which is why a single company-wide click rate hides it.
This quarter, pick one role group, usually finance. Rate your last three simulations for that group on cues and premise fit, and put the click and reporting rates next to each rating. If the ratings are all the same, you have found where the ladder starts, and the next simulation should sit one rung higher for those who reported and one lower for those who clicked.
Frequently Asked Questions
What is an adaptive phishing simulation?
It is a program where each person receives simulations chosen for them rather than one template for everyone. The choice draws on role, behavior history, language and the difficulty level the person has already handled. Strong performers get harder tests, people who struggle get support, and each result is read against the difficulty of the email.
How does adaptive phishing simulation decide difficulty?
It rates each email on two things: the cues that could give it away, and how well the premise fits the recipient's work, as in NIST's Phish Scale. Few cues and a strong fit make an email hard. The person's earlier results then decide which rung of difficulty they receive next.
How is adaptive different from a fixed phishing campaign?
A fixed campaign sends one template to everyone and reports one click rate. An adaptive program changes the lure, channel, language and difficulty per person and keeps going all year. Its reports compare results at the same difficulty, so a low click rate on an easy email is not mistaken for strength.
Does adaptive simulation work in Arabic and English?
Yes, provided the templates exist natively in both languages and language is set per person. Premises should be written for Arabic readers, not translated from English. Whitebait provides Arabic and English templates, so employees can be tested in the language they work in. Rate each version's difficulty on its own, because cues and premise fit can change in translation.
In April 2026 the UAE Cyber Security Council said more than 75 percent of cyber breaches begin with phishing emails, and that prompt reporting helps response teams prevent serious incidents. This post is for UAE and GCC security leaders deciding whether awareness work lowers the chance of a real incident. It explains how phishing simulations reduce risk when they rehearse the attacks real adversaries run, and which changes in behavior to measure.
In short: Awareness tells people what phishing is. Risk falls when simulations rehearse the attacks adversaries run against the executives, finance staff and IT administrators they would target, and when you measure reporting, verification and time to report, not clicks alone.
Where Awareness Ends and Rehearsal Begins
Awareness tells people what phishing looks like: an unfamiliar sender, an urgent tone, a link that does not match. That knowledge is the foundation of every program. A real attack, though, rarely arrives as a generic message. It arrives addressed to one person, about something that person is working on, and sometimes after the attacker has already made contact.
The Verizon 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, shows how much of this sits with people. The human element was present in 62% of breaches. Phishing was the entry point in 16%, and pretexting, where a trusted relationship is built through a concocted scenario, reached 6% and has become a more common way into ransomware and extortion attacks.
Pretexting is the number that matters most here, because it describes what a generic program cannot rehearse: the story. A single annual module and a stock fake-parcel email teach the vocabulary. They cannot practice the moment a finance lead receives a plausible request from a plausible colleague.
NIST makes a related point about measurement. Its Phish Scale rates a lure's difficulty against a specific target audience, and notes that low click rates analyzed on their own can create a false sense of security. The same lure can be easy for one team and hard for another, so the exercise has to be matched to the people receiving it. To match it, you first need to see how attackers do their homework.
How Attackers Research Employees Before Phishing Them
They start with open sources. In a January 2023 alert, the UK National Cyber Security Centre described two groups, based in Russia and Iran, that used social media and professional networking platforms to find hooks that would engage a target, and mapped the target's real-world social and professional contacts.
From there they built the pretext. The groups created fake profiles posing as respected experts, registered webmail accounts that impersonated known contacts, and set up look-alike domains of legitimate organizations. They opened with benign contact on a topic of interest, and the correspondence could run for an extended period before a link to a supposed document or sign-in page appeared.
The same ingredients appear in Gulf warnings. In October 2025 the UAE Government Empowerment Department warned that attackers combine AI, urgency and impersonation of official authorities, and use deepfake technology to deceive employees and mimic voices.
Attackers spend that effort where it pays. An executive's public profile supplies a voice worth borrowing, a finance lead can release payments, and an IT administrator holds privileged access. Much of what the attacker used is public, which means a simulation can be built from the same material.
How Phishing Simulations Reduce Risk at Each Step
A simulation reduces risk when it rehearses each link of that chain against the person who would face it. Each stage asks something specific of a well-built exercise:
Reconnaissance. Build the scenario from what is publicly known about the target: role, projects, events, contacts and the language they work in.
Pretext. Use a story tied to that person's work, such as a conference follow-up, a vendor query or a request from a senior colleague.
Lure. Deliver it through the channel an attacker would pick: email, text, a call, a QR code or a meeting link.
The human decision. Record what the person does: ignore it, report it, verify it through another channel, click, or enter credentials.
Escalation. If the first attempt is ignored or answered, follow up the way a persistent attacker would, with a second message or a different channel.
Escalation is the stage generic programs tend to skip, and real campaigns rarely stop at one message. The NCSC described actors who, after a successful sign-in, read the mailbox, set up forwarding rules and sent further phishing to the victim's contacts. A sequence can rehearse that pressure. It also gives people practice in the habit the UAE Government Empowerment Department recommends for suspicious calls: hang up, look up the official number and call back to verify.
This is the design behind Fraus Blackbait, which runs OSINT reconnaissance on selected targets and escalates attacks autonomously, so the rehearsal follows the chain from research to follow-up instead of a fixed template. The open question is who should face it first.
Who Should Get the Most Realistic Simulations
Start with the people whose compromise costs the most: executives and their assistants, finance and payments staff, and IT administrators with privileged access. Give them scenarios built from their own public footprint and sequences that escalate. A payment-change request is only one of the lures finance staff face, and it has its own breakdown in Invoice Fraud in UAE Construction.
Everyone else still benefits from simulations matched to their role, at lower intensity and in the language they work in, whether Arabic or English. Fraus Odin weights each person's risk by role criticality and behavior, which shows where the next realistic simulation should go.
Simulations built from public information about real people need guardrails first. Agree the scope with HR and legal, keep private social accounts out, confirm how the collected data is handled, and decide in advance how people who click are supported. Reporting only works in a culture where it feels safe.
What Behavior Change Lowers Real-World Risk
Clicks are the easiest number to collect and the least complete. The Council points to a different behavior, prompt reporting. A reported lure gives the response team a head start on every other mailbox that received it. Track four things for each role group:
Reporting rate. The share of targeted people who report the lure, shown next to the click rate.
Time to report. Minutes from delivery to report, since a late report leaves the attacker time to work.
Verification. Whether people confirm an unusual request through a second channel before acting.
Repeat behavior. Whether the same people improve across successive, harder scenarios.
Trend these per group rather than company-wide. When the finance team's time to report falls across escalating scenarios, the rehearsal is working. The board-level view of these numbers is laid out in Security Awareness KPIs for the Board on One Page.
Pick One Group and Build Their Chain
Go back to the Council's two points: most breaches begin with a message, and prompt reporting helps stop serious incidents. Your next step can be small. Choose one high-exposure group, such as finance or the executive office, and write down the attack chain an adversary could build from their public profile. Agree the guardrails, run one escalating scenario, then record who reported, how fast, and who verified. That baseline tells you where to rehearse next.
Frequently Asked Questions
Do phishing simulations reduce real-world risk?
Yes, when they rehearse the attacks adversaries actually run and are measured by behavior. Role-matched, realistic simulations build the habits that interrupt an attack: reporting quickly and verifying unusual requests. The UAE Cyber Security Council links prompt reporting to response teams preventing serious incidents. Track reporting and time to report next to clicks to see the effect in your own data.
What makes a phishing simulation realistic?
It fits the target. The story matches the person's work, the sender is plausible, the channel and language are the ones an attacker would use, and the exercise can follow up if the first message is ignored. NIST rates lure difficulty against a specific audience, so judge realism by how well the scenario fits the people receiving it.
Which employees should get the most realistic simulations?
Executives, finance and payments staff, and IT administrators with privileged access, because compromising them gives an attacker authority, money or access. Prioritize by role criticality and public exposure, then give everyone else simulations matched to their role at a lower intensity.
How do attackers research employees before phishing them?
They use open sources such as company websites, social media and professional networking platforms. The UK National Cyber Security Centre described groups that used these to find hooks, map a target's contacts and build fake personas before sending a lure. Limiting what senior staff publish helps, and simulations built from the same public material show how convincing the result is.
Picture an accounts clerk who clicks a fake invoice link one Tuesday morning and lands on a page saying it was a test. What that page says matters more than the click, because the lesson has the clerk's full attention for a few seconds. This guide is for the security awareness manager or HR and L&D partner at a UAE or GCC organization who runs phishing simulation training week to week.
In short: Treat the click as the start of the lesson. Give specific, blame-free feedback within seconds, follow with a short lesson in the person's language, test again later to see what stuck, and reward reporting so people tell you when they click.
What Phishing Simulation Training Covers
Phishing simulation training sends employees realistic but harmless phishing messages and uses what happens next to teach. The simulation is the prompt. The learning comes from the feedback, the lesson and the follow-up test that come after it.
It matters because people sit inside most breaches. Verizon's 2026 Data Breach Investigations Report, as covered by SecurityWeek, found that 62% of breaches involved a human element. A simulation is one of the few places where a team can watch a human decision as it happens and respond to it.
Measuring that takes more than a click rate. NIST built the Phish Scale to rate how hard a given simulated email is to spot, and its researchers note that numbers alone don't tell the whole story: click rates analyzed on their own can create a false sense of security. NIST recommends pairing the scale with feedback from users on why they clicked.
Programs that run once a year for compliance, or that end at a percentage on a dashboard, leave the most useful moment unused. A program built around the click uses it, and the sections below follow that moment from the first seconds to the next simulation.
The Seconds After the Click
The feedback has to arrive while the decision is still fresh, so the landing page does the first piece of teaching. It should say plainly that this was a simulation, that nothing was taken and that clicking is common. Then it should point at the email the person just acted on.
Specific feedback beats a general warning. "Watch out for suspicious emails" gives the clerk nothing to use, while "the sender domain differed by one letter and the message asked for payment before month end" gives a cue for next Tuesday. The Phish Scale rests on the same idea, rating the cues in a message and how well its premise fits the people who receive it.
A good post-click page holds four things:
A calm opening line, with no scolding and no score
The two or three cues in that exact email, shown beside the email
One action for next time, which is how to report a message like this
A reading time under a minute, so it works between tasks
A page like that starts the learning, but a lesson only lasts if something follows it in the days after.
The Days After: Lesson and Recheck
Within a day or two, the person who clicked should get a short follow-up lesson on the lure they fell for, in the language they work in. Three to five minutes is enough when it covers one idea, such as urgent payment requests or fake login pages.
Codex delivers security awareness training as micro-learning in Arabic and English, and Zero-Touch Training can assign it automatically when a person's behavior shows a gap, so the follow-up does not wait for someone's calendar.
Then close the loop with a later simulation. Choose a different lure at a similar difficulty, so a better result reflects learning and not an easier email, and leave a few weeks between the two so it tests what stuck rather than what the person remembers from last week.
Judge the recheck on reporting as well as clicking. Someone who spots the second lure and reports it has shown more than someone who happened not to click. In Whitebait, reporting rate is tracked next to click rate, so the recheck shows both.
Building the Reporting Habit
A click happens once. Reporting is a habit, and the data shows how much room there is to build it. In security awareness exercise data contributed during 2023 to Verizon's 2024 Data Breach Investigations Report, 20% of users reported phishing in simulation engagements, and 11% of the users who clicked the email also reported it.
So in those exercises, most people who clicked did not report it. That silence costs the most when the email is real, because the security team hears about it late. The UK National Cyber Security Centre (NCSC) is direct about the cause in its phishing guidance: "Users who fear reprisals will not report mistakes promptly, if at all." It asks organizations to help people feel supported in coming forward even after a click.
In the UAE, the Cyber Security Council has said that more than 75 percent of cyber breaches begin with phishing emails or fraudulent messages, as reported by Gulf Today. It also urges people to report phishing attempts promptly, so that response teams can analyze threats and take preventive measures.
Four habits make that prompt report more likely:
Make reporting one tap. The Fraus Teams App gives employees one-tap phish reporting inside Microsoft Teams
Thank every reporter within a day, including people who clicked first
Tell them what happened to the report, since the NCSC advises giving quick feedback on the action taken
Track reporting rate and time to report next to click rate, as in our board KPIs post
Each habit depends on how people expect to be treated when they admit a mistake, which is a question of tone more than tooling.
Coaching, Language and Shift Work
Discipline teaches people to hide mistakes, so coaching has to be the default. The NCSC advises avoiding a punishment or blame-oriented culture around phishing and says blaming users for clicking doesn't work. Agree one line with HR before the first campaign: a click in a simulation is a coaching moment, not a disciplinary one.
Repeat clicks lead to a conversation and extra support, and the same support goes to roles that attract more attacks, such as payments and customer contact.
Language is part of the tone. If an employee works in Arabic, the post-click page, the follow-up lesson and the wording of the report button should be in Arabic too, because feedback the person has to translate in their head loses the seconds it depends on. Where teams work in both languages, let each person choose and keep the explanation of the cues the same in both.
Shift workers set the time limit. A nurse or a site supervisor may have a few minutes between tasks and no free hour. Keep each lesson to one idea that finishes in a break, send simulations across all shifts and not only office hours, and make sure the report route works from the device the person actually carries.
A First Month That Closes the Loop
Back to the accounts clerk on Tuesday morning. The best outcome the next time a fake invoice arrives is a report within minutes, and that outcome is built from small decisions you can make this month.
Rewrite the post-click page so it names the cues in the email. Pick one follow-up lesson for each lure type, in Arabic and English. Put the coaching-not-discipline line in writing with HR. Make reporting rate and time to report the headline numbers for your next simulation, and recheck anyone who clicked a few weeks later.
Start with the page people see after the click. Every employee will see it, and it is the cheapest part of the program to improve.
Frequently Asked Questions
What is phishing simulation training?
Phishing simulation training sends employees realistic, harmless phishing messages and uses their responses to teach. It combines the simulation with immediate feedback, a short follow-up lesson and later simulations that check what stuck. Done well, it measures reporting as well as clicking, so you see whether people recognize and escalate threats and not only whether they avoided one.
What should happen when an employee clicks a phishing simulation?
Within seconds, a calm page explains that it was a test, shows the cues in that exact email and says how to report next time. Within a day or two, a short lesson in the employee's language follows. A few weeks later, a different simulation at similar difficulty checks that the lesson stuck, and a report counts as a success.
How do you build a culture where employees report phishing?
Make reporting one tap, thank people quickly and tell them what happened to their report. The NCSC advises supporting people who come forward even after clicking, and measuring how many people reported, not only how many clicked. HR and leaders need to say the same thing: reporting is welcome and a click is a coaching moment.
Should employees be disciplined for failing phishing tests?
As a rule, no. The NCSC advises avoiding a punishment or blame-oriented culture around phishing and warns that users who fear reprisals will not report mistakes promptly, if at all. Treat a simulated click as a coaching moment, give repeat clickers a conversation and extra support, and agree with HR in advance how any real policy breach is handled separately.
.svg)
.svg)
.svg)
.svg)
.svg)
.png)
.png)
