Methodology
How to run a simulation campaign properly — and the red lines to refuse.
Pre-launch governance pack
Before a single message is sent: a written mandate from the client naming the authorising officer, a defined scope of who is and is not in the population, a no-blame policy communicated in advance, a stated retention period for the data, a named contact for anyone who is distressed, and an agreed abort condition. A simulation without a mandate is an unauthorised intrusion test.
The consent question, answered honestly
Individual prior consent would destroy the measurement, so it is not sought. What is owed instead is transparency at the population level: staff are told in advance that simulations happen, roughly how often, what is measured, what is not, and what happens to the data. Under Swiss law the employer's legitimate interest in security testing is real but bounded by OR 328b and the revised FADP — the processing must relate to the employment relationship and be proportionate.
The individual-versus-aggregate line
This is the line the legal analysis turns on. Aggregate reporting rates, click rates and time-to-report are defensible security metrics. Individual-level performance used for discipline, ranking or performance review is systematic employee monitoring, which OR 328b constrains and which Art. 26 of the Ordinance to the Labour Act prohibits where the purpose is behavioural surveillance. Report by group; keep individual data for the learner's own view and for targeted support, not for consequences.
The metrics that matter
Reporting rate and median time-to-report are the operationally useful numbers, because reporting is the mechanism with field evidence behind it. Click rate is worth tracking as a trend, not as a score, and never as a target — a click rate driven to zero by fear produces a workforce that reports nothing and hides mistakes. False-positive load on the security team belongs in the metrics too: a programme that triples the queue has cost more than it gained.
Red lines to refuse
No lures using redundancy, bonus, salary cuts or bereavement. No impersonation of real named individuals, real brands, or the client's actual customers. No capture of real credentials — the simulation stops at the click. No naming of individuals to managers. No campaigns timed to coincide with restructuring or layoffs. A consultant who cannot say no to these has nothing to sell but compliance theatre.