Security awareness is not a training event. It is an operating capability: a set of habits, drills and feedback loops that decide how an organisation behaves in the minutes after a convincing message arrives. This guide describes how that capability is designed, run, measured and kept alive.
Quick Overview
What you’ll learn:
- Why announcement-based awareness fails and rehearsal-based awareness does not
- How to run phishing simulations that teach instead of humiliating people
- How to segment a programme by risk profile rather than by department
- What an ambassador network does that a central security team cannot
- Which measurements a programme can defend and which ones it cannot
- How sector context changes the content without changing the method
Who this article is for:
- Security leads who own an awareness programme and its budget
- HR and L&D specialists asked to deliver security training at scale
- Team managers whose people are the first to receive a hostile message
Reading time: 24 minutes
Awareness as an Operating Capability, Not an Annual Obligation
Most organisations describe their awareness work in the language of coverage: how many people completed the course, how quickly, and whether the completion certificate reached the compliance file. That vocabulary comes from audit, and it answers an audit question. It does not answer the operational one, which is narrower and harder: when a plausible message arrives at a busy moment, what does the person receiving it actually do?
The gap between those two questions explains why awareness programmes so often feel active and produce so little. A completed course proves exposure to material. It does not prove that a habit changed, that a reporting path is known, or that someone under time pressure will pause long enough to check a sender domain. Exposure and behaviour are different variables, and only the second one is defended in an incident.
Treating awareness as an operating capability means accepting the same conditions applied to any other capability. It has an owner. It has a cadence rather than a launch date. It is exercised under conditions that resemble reality, not under conditions that flatter the exercise. It produces telemetry, and that telemetry is used to change the programme rather than to decorate a slide. It degrades if left alone, so it is maintained deliberately.
This framing is not a rhetorical preference. NIST SP 800-50 organises a learning programme around design, development, implementation and continuous assessment, and treats the last of those as inseparable from the first three. A programme that ends at delivery has skipped the part that makes it a capability at all. NIST SP 800-50 also separates awareness from role-based training and from formal education, which matters in practice: an organisation that buys one and reports it as another will discover the difference during an incident, not before it.
Regulatory pressure has moved in the same direction. Directive (EU) 2022/2555 places responsibility for cybersecurity risk-management measures on management bodies and requires those bodies to follow training, with an expectation that similar training is offered to staff on a regular basis. Under Directive (EU) 2022/2555 the obligation is not satisfied by a library of recorded material sitting unopened on an intranet. The word that carries the weight is regular.
Practice Over Announcement: Why Exercises Change Behaviour
Information about threats is abundant and cheap. Almost every employee has been told that phishing exists, that passwords should be strong, and that unexpected attachments deserve suspicion. Repeating that message with better graphics does not move the outcome, because the constraint was never a shortage of information. The constraint is that recognition has to happen fast, under load, in the middle of ordinary work, and knowledge stored as a fact does not retrieve well under those conditions.
Rehearsal does. A person who has already seen a convincing fake invoice, argued about it with a colleague, and been told afterwards which detail gave it away has stored something different from a definition. They have stored a pattern with an emotional marker attached to it. That marker is what fires when the real message arrives, and it fires faster than deliberate reasoning.
The practical consequence is that exercise design deserves more attention than content design. A workshop where teams examine real messages captured by the organisation’s own filters teaches more than a polished module about message categories in the abstract. The captured messages carry local context: the supplier names people recognise, the internal systems they use, the tone their finance department actually writes in. That local texture is exactly what a generic module removes, and it is exactly what makes an attack convincing.
The ENISA Cybersecurity Culture Guidelines make the same point from the behavioural side: interventions that ask people to do something, in context, with feedback, shift behaviour more reliably than interventions that ask them to absorb something. The guidance is worth reading directly, because it is unusually explicit about the fact that awareness measured as knowledge and awareness measured as behaviour do not track each other.
There is a second-order benefit. Exercises produce disagreement, and disagreement produces conversation. When a team argues about whether a message was legitimate, they are collectively building a shared threshold for suspicion, and that shared threshold is more durable than an individual one because it is socially reinforced afterwards.
Simulated Phishing Done Without Doing Harm
Simulated phishing is the most powerful instrument in the awareness toolkit and the easiest one to misuse. Done well, it converts an abstract risk into a personal, memorable, low-cost failure. Done badly, it teaches people that the security team is an adversary who sets traps, and the resulting silence is far more dangerous than the original click rate.
The distinction lives almost entirely in what happens after the click. If the landing page explains which specific signals were available — the display name that did not match the domain, the urgency that discouraged verification, the link text that concealed a different destination — the exercise has taught something. If the landing page reports the failure to a manager, or produces a name on a list, the exercise has taught something too, but the lesson is that failures must be hidden.
Several design rules follow from this. Simulations should never impose disciplinary consequences for a single click; the appropriate response to a click is immediate, specific, private feedback. Campaigns should be continuous rather than annual, because a once-a-year test measures luck. Difficulty should be calibrated deliberately, with a mixture of obvious and genuinely hard lures, so that both the floor and the ceiling of the organisation’s recognition are visible. Themes that exploit personal distress — payroll errors, redundancy notices, medical results — buy a high click rate at the cost of trust, and the trust is worth more.
The most valuable metric produced by a simulation programme is not the click rate at all. It is the report rate, and specifically the time between delivery and the first report. Click rate measures individual failure and drifts downward as people learn the sender address of the simulation platform. Report rate measures whether the organisation has a working nervous system: whether someone who notices something wrong knows where to send it and expects that sending it will be useful rather than embarrassing.
Simulation programmes also need governance, and organisations routinely discover this late. Results identify individuals, which makes them personal data with a purpose, a retention period and an access list; treating a simulation platform’s reporting screen as an informal management tool is how an awareness programme acquires a data protection problem. In jurisdictions with employee representation, running behavioural testing on staff without prior consultation is a reliable way to have the programme suspended by people who were never opposed to it in principle. Both problems are cheap to prevent and expensive to remediate: define upfront who may see individual-level results, for how long they are kept, what aggregate reporting looks like, and what the results will never be used for.
Anyone designing these campaigns should first understand the attack they are imitating, including the pretexts and the pressure mechanics that make it work in the first place; our guide to phishing and social engineering covers those mechanics in detail.
Threat Recognition in the Ordinary Working Day
A programme that trains recognition only inside the mail client has covered the loudest channel and left the others open. Recognition has to work wherever a request can arrive, and requests arrive through chat platforms, phone calls, supplier portals, calendar invitations, physical visitors and increasingly through voice and video that sound and look like someone the recipient knows.
The teachable core is not a catalogue of channels. It is a small set of structural signals that survive translation across all of them. An unexpected request combined with time pressure. A request to break a known process “just this once”. A request to move the conversation to a channel where the usual controls do not apply. A sender whose identity is asserted rather than verified. A request whose beneficiary is different from its apparent author. These signals are channel-independent, which is why they are worth teaching and why a channel-by-channel curriculum ages badly.
Regular short exercises keep those signals available. A brief scenario discussed at a team meeting — a supplier calls to update bank details, a colleague messages from an unknown number about an urgent transfer — costs little and rehearses the pause that matters. The point of the pause is not to reach a verdict; it is to create the moment in which verification becomes possible.
Synthetic voice and video deserve specific mention, because they break an assumption the workforce has held its whole working life: that hearing a familiar voice or seeing a familiar face is identification. It no longer is, and telling people this once in a slide does not dislodge a lifetime of reliance on it. What works is giving them a replacement rule that is simple enough to apply under pressure — that identity is established by the channel, not by the voice, and that any request with financial or access consequences is confirmed through a route the requester did not choose. A pre-agreed verification phrase within a team costs nothing and converts an unanswerable question about authenticity into a routine one.
Verification must be cheap enough to actually happen. If confirming a payment change requires an email to a shared inbox that answers in days, people will not confirm; they will guess. A programme that trains suspicion without shortening the verification path is asking people to carry a cost the organisation refused to pay. Publishing a known-good internal number, a named contact, or a chat channel with a service expectation does more for recognition than another module.
Procedure Drills: Testing What People Do, Not What They Recall
Organisations write procedures for incidents and then test whether people can recall them. Recall tests reward the wrong thing. Under stress, nobody retrieves a document; they follow whatever path is most available, and the most available path is the one they last walked.
Drills make the correct path the available one. A short, announced exercise — a suspected compromise of a laptop, a lost phone with mail access, a document sent to the wrong external recipient — reveals whether the reporting route is known, whether it works outside office hours, and whether the person reporting believes they will be helped rather than investigated. Each of those failure modes is invisible to a quiz and obvious within minutes of a drill.
Drills also surface the procedural defects nobody wants to raise in the abstract. The reporting form that requires information the reporter does not have. The escalation path that terminates in a role that no longer exists. The rule that says devices must be reported immediately and the process that only accepts reports during business hours. These are cheap to fix once seen and expensive to discover during a real incident.
The tone of a drill decides what it produces. If a drill is framed as an audit of individuals, participants optimise for looking competent, and the organisation learns nothing about its real behaviour. If it is framed as a test of the process, with the explicit statement that a confusing process is a defect of the process, participants report the confusion, and that report is the deliverable. NIST SP 800-50 treats this kind of feedback as part of the assessment loop rather than as an accident of delivery.
Programme Architecture: Segmentation by Risk Profile
Uniform awareness content is administratively convenient and operationally weak. A finance officer who authorises payments, a developer with production credentials, an executive assistant with calendar and mailbox access, and a warehouse operator with a shared terminal face different attacks, hold different leverage, and need different rehearsals. Delivering the same module to all of them optimises for reporting, not for risk.
Useful segmentation is built on exposure and leverage rather than on the organisation chart. Exposure asks how often a role receives external, unverified contact. Leverage asks what an attacker gains from compromising that role: money moved, data exfiltrated, systems reached, identities issued, suppliers impersonated. A role that is high on both axes deserves depth, frequency and scenario realism that would be wasted elsewhere.
The output is a small number of named profiles, each with its own scenario library, cadence and difficulty. Payment-authorising roles rehearse supplier bank-detail changes and invoice manipulation. Privileged technical roles rehearse credential harvesting, malicious dependency prompts and support-desk impersonation. Executive-adjacent roles rehearse authority pressure and out-of-band requests. Frontline roles rehearse physical access and shared-device hygiene. Everyone shares a common baseline, which stays short precisely because the specialised content carries the weight.
The shared baseline deserves more design attention than it usually gets, because it is the only part of the programme that everybody sees. Its job is narrow: establish what the organisation considers a suspicious signal, make the reporting path unmistakable, and state the non-punitive stance explicitly enough that people believe it. Everything else competes for attention with the specialised content and loses. Baselines fail when they are used as a dumping ground for every policy statement that needed an audience, at which point they become long, generic and unmemorable, and the specialised content inherits an audience that has already decided the programme is not worth attention.
Segmentation also solves a political problem. When content is visibly tailored, participants stop experiencing training as a tax levied on their time by a department that does not understand their job. Relevance is the cheapest available driver of engagement, and it is bought with analysis rather than with production budget. A structured programme such as cyber security awareness training is straightforward to run in profile-specific cohorts once the profiles themselves have been defined.
Micro-Learning and the Cadence Problem
The annual training session is a scheduling artefact rather than a learning design. It concentrates all delivery into a single moment, competes with the working day at its least flexible, and then leaves the rest of the year empty. Retention decays across that emptiness, and the decay is steepest immediately after delivery — exactly when the organisation records the training as complete.
Distributed micro-learning inverts the shape. Short units, delivered on a rhythm, each addressing a single behaviour, cost less per interruption and are far easier to schedule honestly. A brief unit on verifying a payment change, another on recognising authority pressure, another on what to do with a suspicious attachment, spread across the year, produce more retrievable behaviour than the same total minutes delivered at once.
Cadence has to be designed rather than assumed. Too sparse and the programme stops being present; too dense and it becomes noise that people learn to dismiss, which is worse than absence because dismissal generalises. The practical approach is to set a rhythm, publish it, and treat deviations from it as programme defects. ENISA Awareness and Cyber Hygiene material is organised around exactly this idea of hygiene as something practised continuously rather than acquired once.
Micro-learning does not remove the need for depth. It changes what depth is for. Long-form sessions become the place where difficult material is discussed, where scenarios are argued through, and where people meet the humans behind the security function. Short units maintain the habits between those sessions. Neither substitutes for the other, and programmes that try to run on short units alone tend to produce familiarity without competence.
Advanced Formats and Internal Certification
Once a baseline exists, the interesting question is how to build genuine capability in the roles that need it. Several formats do this reliably. Tabletop exercises put a cross-functional group through a scenario and expose the coordination failures that individual training never touches. Live-fire workshops, where participants examine real captured artefacts, teach forensic attention. Structured debriefs after genuine incidents convert an unpleasant event into shared organisational memory, provided the debrief is about mechanism rather than blame.
Internal certification is the format most often built badly and most valuable when built well. A meaningful internal certification defines a competence, tests it in a way that can be failed, and grants something that carries visible standing. A certification that cannot be failed is a completion record with a border around it, and everyone involved knows this within a cycle.
The design questions are concrete. What can the holder do that a non-holder cannot be trusted to do? Is the assessment behavioural — handling a scenario, running a review, making a judgement call — or is it recall? Does the certification expire, and does renewal require demonstrating current competence? Does holding it change anything: access, responsibility, recognition, a role in incident handling? If the answer to the last question is no, the certification is decoration.
Gamified formats — leaderboards, capture-the-flag style challenges, inter-team competitions — sit alongside these and deserve a caution. Competition raises engagement quickly and reliably, and it also changes what participants optimise for. A leaderboard built on report rate produces reports, including low-quality ones submitted to move up the board, which then consume triage capacity the programme needs. A leaderboard built on click rate produces silence around clicks. The usable version of gamification rewards participation and improvement rather than ranking individuals against each other, and keeps the competitive frame at team level where it reinforces the social threshold for suspicion instead of undermining it.
Where internal certification works, it produces a population of people who are genuinely more capable and visibly identified as such. That population is the raw material for the ambassador network described below, and building it deliberately is more efficient than hoping it emerges.
Security Culture: Leadership, Communication, Accountability
Culture is the residue of what an organisation rewards and tolerates. It is not created by a poster campaign and it is not changed by a statement of values. In security, it shows up in a small number of observable behaviours: whether people report mistakes quickly, whether they challenge unusual requests from senior figures, whether they ask for exceptions or work around controls silently, and whether the security function is consulted early or presented with finished decisions.
Leadership behaviour dominates all of these. When senior figures request exemptions from controls, the exemption is the message, and it is far louder than any communication campaign. When a senior figure reports their own near-miss publicly, that is also the message, and it reduces the cost of reporting for everyone below them more effectively than any policy sentence. Directive (EU) 2022/2555 codifies part of this by placing training obligations on management bodies themselves rather than only on staff — a recognition that the behaviour of the top of an organisation is a control, not a courtesy.
Communication has to be bidirectional to matter. A security function that only broadcasts is a source of noise; one that publishes what it learned from reports, credits the people who raised them, and explains why a rule exists is a participant in the organisation’s work. Explaining the reasoning behind a control is not optional politeness — an unexplained rule is followed only while it is convenient, and control design that assumes otherwise is fragile.
Accountability is the part most often handled badly. The instinct to punish clicks is understandable and counterproductive, because the behaviour an organisation most needs is voluntary self-reporting of mistakes, and punishment is the most efficient way to eliminate it. The workable distinction is between error and disregard. An error made while trying to do the job correctly is programme feedback. Deliberate, repeated circumvention of a control that the person understands is a management issue, and treating it as one protects the credibility of the non-punitive stance everywhere else. Executive-level programmes such as cyber security awareness for executives exist largely because this distinction has to be understood at the level where exemptions are granted.
The Ambassador Network
A central security team cannot be present in every meeting where a risky decision is made, and it cannot maintain relationships with every team. An ambassador network — named people embedded in business units who carry additional security responsibility alongside their main role — closes that distance in a way headcount cannot.
What ambassadors provide is local translation and local availability. They know what their team actually does, which shortcuts exist and why, and which security requirements collide with the work. They are close enough that asking them a question costs nothing, which means questions get asked at the moment of doubt rather than after the decision. They also carry information in the other direction: the security function learns what is happening on the ground from people who have no incentive to sanitise it.
The role needs real construction to survive. Ambassadors need protected time, or the responsibility quietly evaporates under delivery pressure. They need a direct channel into the security team and a rhythm of contact. They need training that goes beyond the general baseline, because their credibility depends on being able to answer questions rather than forward them. They need visible recognition, ideally including their line manager’s acknowledgement that the role counts as work. And they need a defined scope, because an ambassador who is treated as a local helpdesk burns out.
In smaller organisations the network is small and informal, which is not a weakness. A single well-supported person in each functional area achieves most of the effect. The failure mode in small organisations is different: the role is assigned to whoever is most enthusiastic, given no time, and abandoned within a cycle. Scope and protected time matter more than scale.
Measurement: What a Programme Can Actually Prove
Measurement is where awareness programmes most often lose credibility, usually by claiming more than the data supports. Completion rates measure administration. Quiz scores measure recall under conditions unlike the ones that matter. Click rates measure something real but drift as people recognise the simulation infrastructure. None of these is worthless, and none of them is evidence that risk has fallen.
A defensible measurement set combines behavioural indicators with process indicators. On the behavioural side: report rate for simulated messages, time to first report, report rate for genuine suspicious messages, and the proportion of reports that arrive from outside the security-adjacent population. On the process side: time from report to triage, proportion of reports acknowledged, and the rate at which reported issues produce a change. The process side matters because it measures whether reporting is worth doing, and reporting behaviour collapses when it is not.
Two further indicators are worth the effort of collecting. The first is whether people report their own mistakes, not just other people’s suspicious messages, because self-reporting is the clearest available signal that the non-punitive stance is believed rather than merely stated. The second is qualitative: what people say in debriefs about why they did what they did. Those explanations routinely reveal that the failure was structural — a process that could not be followed, a verification route that did not exist — and structural failures are not fixed by more training.
External benchmarking is where measurement discipline most often collapses. Comparative figures published by simulation vendors describe populations assembled from their own customer base, tested with their own scenario libraries at difficulty levels the reader cannot inspect, and they are not a control group. A programme that reports itself as ahead of or behind such a figure has made a claim it cannot support, and it has invited a board to manage towards a number that any competent administrator can move by lowering scenario difficulty. Internal trend against the organisation’s own prior state, with scenario difficulty held explicitly comparable, is a weaker-sounding claim and a far stronger one.
Honest reporting also means naming what the programme cannot show. An awareness programme cannot claim credit for an absence of incidents, because incidents are driven by many factors and their absence over a short window is not evidence of anything. It can show that recognition improved, that reporting became faster and broader, and that specific structural defects were found and fixed. Those claims are smaller and they survive scrutiny, which is what makes them useful when the budget conversation happens. The discipline of treating people as a measurable risk surface, rather than as an unquantifiable variable, is developed further in our guide to human risk management in cybersecurity.
Sector Adaptation: Finance, Healthcare, Industrial Operations
The method described here transfers across sectors. The scenarios do not, and using generic scenarios in a specialised environment is the fastest way to lose an audience that knows its own work better than the trainer does.
In financial services the dominant pattern is authority and payment pressure. Attacks target the people who can move money or change payment details, and they exploit the legitimate urgency of transaction deadlines. Rehearsals therefore centre on out-of-band verification of payment changes, on resisting authority framing from apparent senior figures, and on the specific problem of a supplier relationship where bank details genuinely do change from time to time. Regulatory examination is also close, so evidence of programme operation has to be retained deliberately rather than reconstructed.
In healthcare the constraints are different in kind. Clinical staff work under interruption, often on shared devices and shared clinical accounts, and any control that adds seconds to patient care will be circumvented for reasons that are correct. Awareness content that ignores this is discarded on contact. Effective programmes here concentrate on what can be done without slowing care — recognising requests for record access, handling requests from apparent colleagues, and knowing the fastest reporting route — and they treat friction in clinical workflow as a design problem for the security function rather than a discipline problem for the clinician.
In manufacturing and critical infrastructure the exposed surface includes operational technology, long-lived equipment, and a large contractor and supplier population with legitimate access. Consequences are physical, so the reporting threshold has to be lower, and the population to be trained extends beyond the payroll. Programmes that treat contractors as out of scope have excluded a substantial part of their own attack surface. The specific characteristics of these environments are covered in our guide to IT, OT and ICS cybersecurity.
What stays constant across every sector is the method: identify the roles with exposure and leverage, rehearse the scenarios those roles actually face, shorten the verification path, and measure reporting rather than compliance.
Behavioural Design: Stories and Moments That Matter
A pair of techniques from behavioural practice earn their place in a security programme, and both are widely misapplied.
The first is narrative. A described incident with a specific setting, a named role, a decision made under pressure and a consequence is retained far better than a rule, because it gives the listener a situation to recognise rather than a proposition to remember. The requirement is that the narrative be true and locally plausible. Invented statistics dressed as anecdote are detected quickly and cost the programme its credibility permanently. A real internal near-miss, told with the reporter’s consent and without identifying blame, is worth more than any external case study, and the act of telling it publicly reinforces the reporting behaviour that produced it.
The second is intervention timing. Learning delivered at the moment a relevant decision is being made is retained and applied at a completely different rate from learning delivered on a training calendar. In practice this means placing brief, specific guidance at the points where risk actually materialises: when a payment detail is being changed, when an external file is being opened, when access is being granted, when a device is being taken off site, when someone joins or changes role. Joiners and role changes are the highest-value moments available, because habits are being formed rather than replaced.
The ENISA Cybersecurity Culture Guidelines are useful here because they resist the temptation to treat behavioural technique as manipulation. The aim is not to trick people into compliance; it is to remove the friction between wanting to act safely and knowing how, at the moment when acting is possible. Techniques used to obscure that friction rather than remove it produce short-term metric improvements and long-term cynicism.
Continuous Improvement and Ownership
A programme without an owner drifts into a content library. Ownership means a named person accountable for the programme’s outcomes, with the authority to change its content, its cadence and its scope in response to what the measurements show. Without that authority the role is administration, and the programme will keep delivering last year’s scenarios against this year’s attacks.
The improvement loop is simple and it is the part most often skipped. Threat input — from the organisation’s own reported messages, from incidents, from sector information sharing — determines which scenarios are rehearsed next. Programme telemetry determines where recognition is weak. Structural defects found in drills go to the teams that own the processes, with a follow-up. Content that no longer produces engagement is retired rather than reissued. Each cycle should visibly change something, and the change should be communicated, because a programme that visibly responds to its own findings is one that people believe is worth feeding.
Anchoring this loop to a risk framework prevents it from becoming a popularity contest between scenarios. When awareness priorities are derived from an assessed risk picture — which assets matter, which threats are credible, which roles sit on the path between the two — the programme can explain why it is rehearsing what it is rehearsing, and it can defend the choice when someone senior prefers a different topic. Practitioners who need that discipline in a structured form will find it in building information security in accordance with ISO 27005, which treats risk identification and treatment as the input to everything downstream, awareness included.
The final maintenance task is unglamorous: keeping the programme’s own infrastructure honest. Simulation platforms accumulate allow-list exceptions that quietly inflate results. Reporting buttons break during mail client upgrades. Distribution lists drift out of date, and whole populations stop receiving anything. Each of these turns a measured improvement into a measurement artefact. Verifying the plumbing periodically is a small cost against the risk of running a programme that is producing numbers rather than effects. Teams looking for a broader operational grounding will find it in our overview of cybersecurity in practice.
Build Your Skills
If your organisation has awareness content but cannot say what behaviour changed, the gap is usually in exercise design and measurement rather than in the material. Structured cyber security awareness training gives teams the rehearsal patterns, scenario libraries and reporting mechanics that turn a content library into a working programme.
Frequently Asked Questions (FAQ)
Where should an organisation start if it has nothing in place?
Not with content. Start with the reporting path: make sure there is one, that it works, that people know it, and that using it produces a response. A working reporting channel converts every employee into a sensor, and it is the only element that pays off immediately. Content and simulations are worth much more once reports have somewhere to go.
How often should awareness training be delivered?
Continuously, in short units, rather than annually in long ones. An annual session satisfies a compliance record and leaves the rest of the year uncovered, which is where the decay happens. Set a published rhythm of brief interventions, reserve longer sessions for scenario work and discussion, and treat a missed rhythm as a defect rather than an inconvenience.
Is an ambassador network worth building in a small company?
Yes, and it is easier there. In a small organisation a single well-supported person per functional area achieves most of the effect, because the distance between them and everyone else is already short. The failure mode is not scale but neglect: the role is assigned to an enthusiast, given no protected time, and abandoned. Define the scope narrowly and protect the time.
Should employees who click a simulated phishing link face consequences?
No, not for a click. The behaviour the organisation most needs is voluntary reporting of mistakes, and punishment removes it faster than any policy can restore it. Respond to a click with immediate, specific, private feedback. Reserve management action for deliberate, repeated circumvention of a control the person demonstrably understands — which is a different situation, and worth naming as such.
How can a programme prove that it reduced risk?
It usually cannot, and claiming otherwise damages its credibility. What it can show is that recognition improved, that reporting became faster and came from a broader population, that self-reporting of mistakes rose, and that specific structural defects were identified and fixed. Those are narrower claims, they are supported by data the programme actually holds, and they survive the scrutiny that a risk-reduction claim will not.