Awareness Is a Behaviour, Not a Slide Deck: Simulated Phishing and Clause 7.3

Ask most businesses how they handle security awareness and you will hear the same answer: an annual slide deck and a quiz nobody remembers by lunchtime. It ticks a box. It changes almost nothing. When a well-crafted phishing email lands three months later, the slide deck is not in the room. The habit is, or it is not.

Clause 7.3 of ISO/IEC 27001 asks for awareness, and reading it plainly, it asks for a behaviour, not an attendance record. The most reliable way I know to build that behaviour, and to prove it to an auditor, is to practise the real thing in a safe way: simulated phishing exercises.

What clause 7.3 asks for

Clause 7.3 says people doing work under your control must be aware of three things: the information security policy, their own contribution to the information security management system (including the benefits of doing it well), and the consequences of not following it. ISO 27001:2022 backs this with Annex A control A.6.3, information security awareness, education and training.

Notice what is not there. It does not say “run a session once a year.” It says people must be aware, which an auditor reads as: can they recognise a threat and do the right thing when it matters? A register of who attended a webinar does not answer that. A record of how your people responded to a realistic phishing email, and how that response improved over time, does.

Why simulated exercises work

A phishing simulation sends your own people a safe, controlled version of the emails attackers actually use. Nobody is harmed and nothing leaves the building, but the moment is real: the same hover-or-click decision, on an ordinary Tuesday, in the flow of work.

Three things make it effective. It is safe practice, so people learn the tell without paying for the lesson. It is measurable, so you get a click rate, a report rate and a trend instead of a vibe. And it closes the loop: the people who click get short, targeted training then and there, and you test them again. Run that cycle a few times and the click rate falls. That falling number is the evidence, and it is also the point.

One thing worth measuring that most people forget: not just who clicked, but who reported it. A workforce that clicks less is good. A workforce that clicks less and reports more is a functioning detection layer, which is exactly what your incident response process (Annex A controls A.5.24 to A.5.28) depends on.

Three ways to run it, from what you already own to the specialists

You do not need a big budget to start. Here are three routes, and the right one usually comes down to what you already pay for, whether Australian data residency matters to you, and how much program depth you need.

Microsoft Attack Simulation Training (you might already have it)

If your business runs on Microsoft 365 with Defender for Office 365 Plan 2 (included in the E5 suites, or available as an add-on), phishing simulation is already built in. It covers the techniques attackers really use, grouped as credential harvest, malware attachment, link in attachment, link to malware, drive-by URL and OAuth consent grant, plus a no-payload “how-to” teaching option. You pick a lure from Microsoft’s library or build your own, target a group, and the platform assigns training automatically to anyone who takes the bait, then reports who did what. If you already pay for the licence, this is the cheapest way to run a credible program.

Phriendly Phishing (built for Australia)

An Australian platform, developed by local professionals, hosted on Australian cloud and supported locally, which matters if data residency and sovereignty are on your radar. Its content is written for the Australian and wider APAC market and delivered as short microlearning modules, and its stated approach is to train rather than trick, which is the right instinct. If you want local content, local support and Australian data handling, it is a natural fit.

KnowBe4 (the global heavyweight)

The largest and most mature platform in the category, with an enormous library of phishing templates and training content, automated program builders, risk scoring at the individual and organisation level, and gamification to keep people engaged. If you want depth, breadth and mature reporting, and you are running a larger or more complex program, this is the benchmark most others are measured against.

All three do the same core job: simulate, measure, train, repeat. Start with what you already own, and step up to a specialist platform when your program outgrows it.

What an auditor wants to see

When I audit clause 7.3 and A.6.3, I am not looking for a certificate of attendance. I am looking for evidence that awareness is real and maintained. A simulation program gives me exactly that: the information security policy people are being made aware of, simulation results showing response rates, records of training assigned and completed, and a trend over several rounds. If your click rate is lower this quarter than last, you are not asserting awareness, you are demonstrating it.

Do it properly, not as a gotcha

A word of caution, because this can be done badly. The goal is behaviour change, not catching people out. Simulations that humiliate staff, or that use cruel lures such as a fake bonus or a fake redundancy notice, damage trust and teach people to fear the IT team rather than the attacker. Keep it fair, make the follow-up training genuinely useful, fold it into onboarding so new starters are covered, and judge the program by the trend, not by any single person’s slip. Awareness is a team outcome.

Where this fits

Simulated phishing is one part of a working information security management system, not the whole of it. If you want awareness that stands up to both an attacker and an auditor, we build practical ISO 27001 systems (including the clause 7.3 awareness program and the Annex A controls behind it) and provide cyber and information security advisory. For teams building their own system, our ISO mentoring service guides you and provides the independent internal audit. Our companion guide on cyber security awareness training and clause 7.3 covers the free resources worth starting with.

Want awareness you can actually prove? Get in touch for a straight conversation about where your awareness program stands and how to evidence it for certification.

Sources: Microsoft, Attack simulation training in Microsoft Defender for Office 365; Phriendly Phishing; KnowBe4 Security Awareness Training. Product features change; confirm current licensing and capabilities with each vendor before relying on them.