Someone Will Click. Is Your Security Team Ready?

Cybersecurity awareness can help employees recognize threats. But when an attack gets through, it’s the skills and preparation of your security team that determine what happens next.

Every October, organizations remind employees to think before they click. 

• Recognize suspicious emails. 
• Question unusual requests. 
• Report anything that doesn’t look right.

It’s important advice. But it comes with an uncomfortable reality: someone will eventually click.

Even the most security-conscious employee can fall for a convincing phishing attempt, approve a fraudulent request, or unknowingly expose sensitive information. Attackers count on it. And no amount of awareness training can completely eliminate human error.

That doesn’t mean awareness training has failed. It means organizations need to prepare for what happens when awareness isn’t enough.

For Cybersecurity Awareness Month, we spoke with three members of OffSec’s internal IT and security teams about what effective security awareness looks like, where its limitations lie, and why preparing for an attack requires more than teaching employees to recognize one.

Their perspectives reinforce an important distinction: awareness helps people recognize threats. Practical security training prepares teams to respond to them.

Phishing simulations are a familiar part of security awareness programs. Employees receive simulated malicious emails, and organizations measure how many people click, submit information, or report the message.

Lower click rates are encouraging. But they don’t tell the whole story.

“I think the biggest win is the reporting habit,” says Paul Lozano, IT Helpdesk at OffSec.

He’s right to make that distinction.

An employee who recognizes a phishing attempt and reports it has given the security team something valuable: an opportunity to investigate before the threat spreads. And an employee who realizes they’ve made a mistake and reports it immediately may be just as important.

“Anyone can slip up on a busy day,” Paul explains.

That’s a reality organizations need to build their security programs around, not something they can train away.

A strong awareness program creates an environment where employees know what suspicious activity looks like, understand how to report it, and aren’t afraid to speak up when something goes wrong.

Because the difference between a contained incident and a much larger problem may come down to how quickly someone raises their hand.

Security awareness plays an important role in reducing risk. It helps employees recognize social engineering, protect sensitive information, and understand why security policies exist.

But expecting awareness training to prevent every incident puts an unrealistic burden on employees.

Christopher Forte, Security Engineer at OffSec, points out that even strong technical controls have limitations when users are determined to complete an action. Awareness training helps people recognize risks and work with those controls, but it cannot guarantee that every threat will be avoided.

And not every attack depends on someone clicking a malicious link.

Unpatched vulnerabilities, compromised software dependencies, misconfigurations, and other technical weaknesses can expose organizations regardless of how carefully employees handle their inboxes.

That’s why Christopher emphasizes the security team’s responsibility to reduce exposure and provide tools that prevent a single mistake from becoming a major incident.

Consider what happens when an employee enters credentials into a convincing fake login page.

Awareness training may have helped them recognize the warning signs. But once those credentials are exposed, the organization needs people who can investigate suspicious authentication activity, identify affected accounts, revoke access where necessary, and determine whether an attacker has moved further into the environment.

Those are not awareness skills. They’re technical security skills, and they require a different kind of preparation.

The goal isn’t to make every employee a security expert. It’s to make sure the organization has security experts who are ready when they’re needed.

Imagine an employee reports a suspicious email after opening an attachment.

What happens next?

Someone needs to determine whether the attachment was malicious. If it was, responders may need to investigate the endpoint, identify related activity, isolate affected systems, and assess whether additional accounts or devices are compromised.

Paul describes the security team’s responsibility simply: investigate whether the threat is real, contain it, and clean up.

But the work rarely happens in isolation.

“Many times, security teams don’t have the access to fully stop or mitigate an attack and may need help from other groups,” Christopher explains.

An incident might require infrastructure engineers to isolate a system, developers to address an exploited application, or IT administrators to revoke access. Leadership may need to make decisions about business disruption, while legal and communications teams prepare for potential obligations and external inquiries.

Even technically capable security teams can lose valuable time when responsibilities are unclear.

That’s why Christopher stresses that “security teams should be able to organize and communicate effectively across relevant teams.”

Knowing how to investigate an attack is essential. Knowing who can authorize a containment action, who has access to the necessary systems, and how to coordinate those decisions is equally important.

Austen Bommarito, Sr. Director of IT at OffSec, also emphasizes the need to prepare for difficult operational decisions. Containing an attack may mean temporarily interrupting a critical service or restricting access to systems employees depend on. Teams need to understand those trade-offs before they’re forced

The middle of an incident is a terrible time to discover that nobody knows who owns the next step.

Most organizations have some form of incident response plan.

But having a plan and being able to execute it are two very different things.

An incident doesn’t unfold neatly. Information is incomplete. Teams are working under pressure. A decision that seems straightforward on paper can become complicated when it affects production systems, customers, or critical business operations.

That’s why security readiness has to be practiced, not assumed.

Paul recommends tabletop exercises and mock phishing incidents to help teams understand their responsibilities and rehearse the steps needed to contain a threat.

Christopher also highlights the value of realistic red team engagements, where adversary behavior is emulated to give internal defenders an opportunity to detect and respond to attacks under more realistic conditions.

These exercises test different but complementary capabilities.

A tabletop might reveal that nobody knows who has authority to take a critical system offline. A technical simulation might uncover gaps in detection, investigation, or containment. A cross-functional exercise might expose delays between identifying a threat and getting the right people involved.

The objective isn’t simply to complete the exercise. It’s to find the weaknesses that need attention.

Organizations should be asking:

• How quickly did we recognize and investigate suspicious activity?
• Could our security team determine what the attacker had accessed?
• Did responders know how to use their tools and execute containment procedures?
• Were the right people involved when technical decisions affected business operations?
• What did the exercise reveal that we need to improve?

Austen also emphasizes the importance of learning from those results. Exercises should lead to better playbooks, clearer responsibilities, and stronger technical defenses rather than becoming another completed compliance activity.

And as Christopher puts it, “Security teams should know how to use the tools they are provided before an incident rather than trying to learn them during a live incident.”

That should be a baseline expectation for every security organization.

Cybersecurity Awareness Month is an important reminder that everyone has a role in protecting their organization.

Employees should know how to recognize suspicious activity, handle sensitive information, and report potential threats. Those habits matter, and organizations should continue reinforcing them.

But security doesn’t end with the employee who spots the phishing email. And it certainly doesn’t end when someone misses one.

Organizations also need security professionals who can recognize attacker behavior, investigate unfamiliar activity, understand how threats progress, and take decisive action to contain them.

Those capabilities aren’t developed through awareness presentations or written procedures alone. They come from hands-on training, realistic exercises, and repeated opportunities to apply technical skills under pressure.

At OffSec, we believe practical experience is fundamental to building that capability. Security teams need more than knowledge of what an attack looks like. They need the skills and confidence to respond when it happens.

So this Cybersecurity Awareness Month, keep reminding employees to think before they click.

But don’t build your security strategy around the assumption that everyone always will.

Train for the click that gets through.