Does not shame, punish, or publicly name people who click

Treats clicks as data about the Program, not as verdicts on people.

Security research argues that scaring and bullying people into security does not work, and staff in a hospital study reacted to Simulations with fear, shame, and hostility. Deterrence research finds perceived sanctions can reduce misuse, so the evidence is not one-sided.

How to observe it: Written policy on consequences; self-report rates after clicks; employee sentiment surveys.

Supporting evidence

• Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital Tolsdorf et al., 2025
• Scaring and Bullying People into Security Won't Work Sasse, 2015

Context

• Cyber security fear appeals: unexpectedly complicated Renaud & Dupuis, 2019

Challenging evidence

• User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach D'Arcy et al., 2009
• Protection motivation and deterrence: a framework for security policy compliance in organisations Herath & Rao, 2009