Hoxhunt

1.0 What conventional programmes measure

The standard awareness programme reports two numbers: how many people completed the module, and what proportion clicked the quarterly simulation. Both are easy to collect. Neither describes risk.

Completion records attendance. A click rate records one event per quarter for each person, which is too few observations to distinguish an employee who is improving from one who was lucky. An organization can hold a perfect completion record and a falling click rate while remaining exactly as exposed as it was.

The measure that correlates with defence is reporting: how many people recognise something and say so, how quickly, and whether that holds under a lure they have not seen before. That requires frequent, varied, individually calibrated practice, which is the design this product argues for.

2.0 How the adaptive model operates

Each employee receives simulations at an individually determined frequency and difficulty. Success moves a person to harder lures. Failure produces an immediate short lesson rather than a note to a manager. The system is therefore always operating near the edge of a person's ability, which is where practice produces change.

3.0 What the vendor reports, and how to read it

Hoxhunt publishes outcome figures from its own customer base, including a stated six-fold improvement in recognising and reporting social engineering within six months, and a substantial reduction in malicious clicks. These are the vendor's own measurements, drawn from organizations that chose to buy the product, and should be read as an indication of the shape of the effect rather than as a forecast for your organization.

4.0 What is included

5.0 Fit, and the case against

5.1 Suited to. Organizations of a few hundred people or more that already run awareness training, are dissatisfied with what it demonstrates, and have someone who will look at the resulting numbers. The product is designed to produce a trend, and a trend nobody reads is an expense.

5.2 Not suited to. Organizations of twenty people, or those whose requirement is a completion certificate for an insurer. A simpler product will satisfy that at lower cost, and buying a measurement platform to produce a certificate is poor value.

5.3 Conditions. Continuous simulation touches every employee repeatedly, so it requires visible support from leadership and, in several jurisdictions, consultation with staff representatives. Confirm your own position on that before the pilot rather than after it.

5.4 On the numbers. Improvement in reporting is a proxy for resilience, not a measure of it. Treat it as one input beside technical controls, not as evidence that the phishing problem has been solved.