Run a phishing simulation before an attacker does

Sending a safe, simulated phishing email to your own team (many M365 and third-party tools support this) shows you who clicks, without any real risk, so you know where training is genuinely needed. Follow it with short, blame-free coaching for anyone who clicked — the goal is awareness, not punishment.

Coach's tip: repeat it every few months; one test creates a moment of awareness, regular tests create a habit.