Chapter 9 — Communication, ethics and reporting
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Communicating without fear"]
N2["9.2 Simulation decision"]
N3["9.3 Reporting upwards"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Communicating without fear"]
N2["9.2 Simulation decision"]
N3["9.3 Reporting upwards"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Communicating without fear]
|
v
[9.2 Simulation decision]
|
v
[9.3 Reporting upwards]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) communicate security messages without fear; (2) decide ethically about simulations; (3) report to managers and the board.
9.1 Communicating without fear
Grace writes short monthly messages for staff with one recent example, one simple action and thanks for reports. She avoids frightening images and threats of discipline. Bada, Sasse and Nurse (2019) found that fear-based campaigns often fail. She also writes a short notice for tenants on the website and in newsletters: Ferngate will never ask for bank details by email or text, and tenants can call the main number to check. Messages focus on what people can do, which builds confidence. Staff like them.
9.2 Simulation decision
Managers ask whether Ferngate should run simulated phishing. Grace considers the evidence, including Lain, Kostiainen and Čapkun (2022), which found that some common simulation practices did not help. She recommends no simulations in the first year while reporting and controls bed in. If simulations are used later, they must follow rules agreed with staff representatives: announced programme, no lures about pay, housing or health, immediate kind feedback, aggregate results and no use in performance processes. Managers accept her recommendation. The decision is recorded in the minutes.
9.3 Reporting upwards
Grace reports quarterly to managers and annually to the board. Reports include outcome measures, such as the share of suspicious messages reported and time to verdict, controls verified, near misses and staff burden. She states limits honestly and avoids claiming that Ferngate is fully protected. The board asks good questions about contractor fraud and tenant privacy, which Grace answers using her evidence. Clear reporting builds trust between the coordinator and leaders, which secures support for the programme. The board thanks her.
Worked example
Grace writes fear-free staff and tenant messages, recommends no simulations in year one with strict rules thereafter and reports outcomes honestly to managers and the board.
Synthetic case. Communications are synthetic; Bada et al. (2019) and Lain et al. (2022) are real.
Errors and limits
Monthly messages can become routine. Board attention varies.
Exercises
- EX041 — Message parts. What does each monthly message contain? Rubric: 3 = an example, an action and thanks;; 2 = three;; 1 = warnings;; 0 = none.
- EX042 — Tenant notice. What does the tenant notice promise? Rubric: 3 = Ferngate never asks for bank details by email or text;; 2 = never;; 1 = vague;; 0 = none.
- EX043 — Simulation recommendation. What did Grace recommend for year one? Rubric: 3 = no simulations in the first year;; 2 = no simulations, without the first-year limit;; 1 = monthly;; 0 = no answer.
- EX044 — Banned lure topics. Which lure topics are banned if simulations are used later? Rubric: 3 = pay, housing or health;; 2 = distress;; 1 = vague;; 0 = none.
- EX045 — Report contents. What do Grace's reports include? Rubric: 3 = outcomes, verified controls, near misses and burden;; 2 = outcomes;; 1 = activities;; 0 = none.
Synthesis
Communication without fear, careful simulation decisions and honest reporting sustain trust.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →