Turning human risk into human resilience

In the course of digital transformation the focus is often on endpoints, cloud infrastructure and compliance. Yet one unpredictable element remains: the human voice. A 50-week campaign shows how vulnerability can be turned into resilience.

Why vishing is so dangerous

While companies invest millions in email filters, phishing simulations and technical defences, one attack vector remains chronically underestimated: the telephone. Vishing, or voice phishing, exploits the immediate, personal nature of a phone call. Unlike with an email, the victim has no time to check links or ask colleagues. The human voice creates trust, urgency and authority in real time.

In our work at HRC we see it time and again: organisations that perform excellently in phishing simulations fail vishing tests with alarming regularity. The problem is not a lack of intelligence; it is a lack of training for precisely this attack vector.

The approach: a 50-week campaign

Together with an international financial services provider we developed a programme that ran for an entire year. The idea: instead of a one-off awareness training, we rely on continuous, realistic simulations combined with targeted training. Every week a rotating group of employees received simulated vishing calls, professionally carried out by our social engineers.

Phase 1: baseline measurement

In the first four weeks we conducted a baseline measurement without the workforce being informed about the programme. The scenarios were realistic but not extreme: a caller posed as internal IT support and asked for confirmation of credentials for a supposed system update.

The results were sobering:

• 62 % of the employees contacted disclosed confidential information
• 38 % shared their complete login details
• Only 11 % asked critical questions or refused to provide information
• Not a single call was reported to IT security

A 62 percent success rate on the first vishing attempt is an open barn door for any social engineer with a phone.

Phase 2: targeted training

Based on the baseline results we identified specific weaknesses and developed tailored training modules:

• Recognising manipulation by authority: how do you react when the caller claims to be acting on behalf of the CEO?
• Dealing with time pressure: techniques for recognising and breaking artificially created urgency
• Verification processes: concrete steps to verify a caller’s identity without appearing rude
• Reporting channels: clear, simple processes for documenting and escalating suspicious calls

The training sessions were short, practical and tailored to real scenarios from the baseline phase. No PowerPoint marathon, but interactive sessions with role plays and live demonstrations.

Phase 3: continuous simulation and improvement

From week 8 onwards, training and simulations ran in parallel. The scenarios became progressively more demanding: from the simple IT support pretext to CEO fraud scenarios and complex pretexts with spoofed phone numbers and insider knowledge. Every simulation was evaluated anonymously and the results fed into the next round of training.

The tone was decisive: we never worked with blame. Anyone who fell for a simulation promptly received an individual, constructive feedback conversation. This created a culture of learning instead of a culture of fear.

Results: measurable behavioural change

After 50 weeks the final measurement showed a fundamental change:

• The success rate of vishing attacks fell from 62 % to 8 %
• 74 % of employees asked verified questions
• 89 % of suspicious calls were reported correctly
• The average response time to reported incidents fell by 60 %

From a 62 % success rate to 8 %: that is not a statistic. That is proof that human resilience can be trained.

Conclusion: resilience is not a state but a process

This project has shown impressively that human risk can be systematically turned into human resilience. But it takes time, continuity and the right approach. A one-off awareness day is not enough. An annual e-learning is not enough.

What it takes is a programme that meets employees where they are, and accompanies, challenges and strengthens them over months. Resilience is not a state you reach once and then tick off. It is an ongoing process that has to be maintained and developed.

At HRC we accompany organisations on exactly this path. Because we know: the strongest firewall in the world is useless if an employee gives away their password on the phone.