A vendor payment is due. Accounts payable gets a request to update the vendor’s bank details. The person handling the payment knows to verify the request. To put the payment on hold, they also need a reliable number to call, the authority to delay the transfer, and a procedure they can use when the due date is close. Calling employees the “weakest link” puts all of that down to one person’s vigilance. Behavioral science helps companies see how the decision gets made and test changes to the way the work is set up.

Why do people struggle to follow rules they already know?

Beautement, Sasse, and Wonham (2008) conducted 17 interviews across two companies to understand how people balance security requirements with the work they’re expected to deliver. They proposed the idea of a “compliance budget” to describe the costs employees weigh when following security rules. Interviewees considered what a rule protected, how much time it took to follow, and what it meant for the task at hand. When a security check delays time-sensitive work, the employee has to reconcile two demands from the same employer.

France’s Cybermalveillance.gouv.fr (2026) advises confirming a request to change payment details by calling the payee on a number you already use. For that check to happen, accounts payable needs access to the vendor’s contact information on file and a clear answer about who can hold the payment. If the company tracks on-time payments closely and the procedure has no provision for a hold, the employee making the check also has to explain the delay. The check becomes easier to carry out when the payment process treats the hold as a normal part of verification.

What can phishing training and simulations tell us?

Ho and colleagues (2025) ran ten simulated phishing campaigns over eight months involving more than 19,500 employees at a healthcare organization. They found no statistically significant association between recent completion of annual security awareness training and the likelihood of failing a simulation. In the randomized part of the study, training shown after employees interacted with a simulated message made very little difference to failure rates in absolute terms. Completion records tell security leaders who took the training. Simulations show what employees did in the situations they encountered.

Lain, Kostiainen, and Čapkun (2022) followed more than 14,000 employees at one company over 15 months. A reporting button in the email client gave employees a way to flag suspicious messages and helped the security team detect new phishing campaigns quickly. The researchers found the volume of reports manageable for the security team they studied. An employee who reports a suspicious message gives the team information it can use to protect other recipients.

Click rates are easiest to interpret when the exercises are comparable. The NIST Phish Scale (Dawkins and Jacobs, 2023) helps assess how difficult a simulated message is to recognize, given the clues in the message and the recipients’ work context. A higher click rate might reflect a scenario that fits more closely with the team’s everyday work. A security lead who accounts for that difference is better placed to interpret what changed between exercises.

What happens after someone reports a suspicious email?

An accessible reporting button makes the first step easier. The company also needs to know who receives the report, who triages it, and who responds to the employee. An acknowledgment tells the employee their report was received. A brief update, when the team can share one, shows the employee what happened next and when it makes sense to reach out again.

Reporting takes on a different cost if the employee has already clicked or thinks they made a mistake. They have to say what they did, knowing they might be judged for it. Psychological safety helps explain that hesitation. A manager who listens and gathers the relevant facts before assigning responsibility makes it easier for the security team to get the information it needs. The investigation can then build on what the employee reported and what the technical team was able to confirm.

How can behavioral science improve cybersecurity practices?

The COM-B model developed by Michie, van Stralen, and West (2011) helps teams work out why a specific check gets skipped. Does the accounts payable employee know where to find the vendor’s number on file? Can they hold the payment while they reach the vendor? How does their manager respond when a check delays payment? If the employee is unsure how to verify a request, practice can help. If the employee knows what to do, the team can look at whether the software or approval rules give them a way to do it.

In UNREST’s MEET method, Model starts with a review of recent changes to vendor bank details to see how people approved them. In Engineer, the information security lead and accounts payable team address the obstacle they found. They might make the verified contact easier to find in the vendor record. In Experiment, they pilot the change and track whether people complete the check and how long payments take. If the results support a wider rollout, Transfer means putting the practice into the standard procedure and checking whether people still use it once pilot support ends.

Before a payment goes out, verification helps the team confirm the request. After a suspicious interaction, a report gives the security team a chance to assess what happened. Each decision has a behavior you can observe and an outcome you can track.

Decision Practice to test Behavior and outcome to track
Approve a change to bank details Before approval, accounts payable confirms the request with the vendor using a phone number already on file. Share of requests verified before approval. Track how long legitimate payments take.
Report a suspicious email The recipient uses the company’s reporting channel as soon as they notice a suspicious message. In a simulation, track the share of delivered messages reported and the time from the first deliveries to the first report. For real alerts, track triage outcomes.
Report after interacting with a message An employee who thinks they interacted with a malicious message alerts the security team and describes what they did. In documented cases, track the time between when the employee recalls noticing a problem and when they reported it. Check whether security received enough information to assess the alert.
Triage a report The security team acknowledges and triages the report, then tells the employee what happens next when it can share that information. Time from receipt to triage. Share of reports acknowledged and, when an update can be shared, followed up.

What should you track beyond click rates?

For accounts payable, a behavioral indicator is the share of requests to change vendor bank details that are verified through the designated channel before approval. Count every request covered by the procedure, including expedited ones. A checked box records that someone says the verification happened. Reviewing a sample of records helps establish whether they used a contact already on file and verified the request before approving it.

In a simulation, track the share of delivered messages that employees reported and the time from the first deliveries to the first report in the campaign. With real alerts, the time between the first report and triage tells you how quickly the organization responded. The team often has no reliable count of all the malicious messages employees actually received. More reports can reflect better reporting, more suspicious messages, or both. Comparing reports with their triage outcomes helps security leads see what’s coming in and what the team is able to assess.

A pilot can also reveal unintended effects. If employees complete more checks but legitimate payments take longer, the accounts payable lead can see where requests are getting held up. Comparing the pilot with a similar team that still follows the standard procedure, or rolling out the change in stages, can help explain the difference. Leadership can then weigh how often checks happen alongside what they do to payment times.

Which decision should you start with?

The security lead and the business process owner can reconstruct the decision behind a recent incident or near miss. If an accounts payable employee spotted a problem and lacked authority to hold the payment, start with whoever sets the approval rules. If reports arrive quickly but sit in a queue, the security team can examine how it triages them. UNREST’s advisory work on human factors in cybersecurity starts with decisions like these so business and security teams can test a change and see what it does.

Frequently asked questions

Who should be involved in reviewing human factors?

Bring in the information security lead, the business process owner, and the people who perform checks or receive reports. A review of bank detail changes, for example, involves accounts payable and the people who maintain vendor records. Walking through one request together shows who has the vendor’s contact information, who can put a payment on hold, and who can release it.

How should you handle a report that turns out to be harmless?

Treat it as a good-faith report and consider whether the message was reasonably suspicious given what the recipient knew. If several people flag the same legitimate internal email, the team that sent it can look at what recipients had available to recognize it. The reports give that team feedback on its own communications.

How do you choose between training and a procedure change?

Watch someone carry out the check in the course of their regular work. If they have the time and tools but are unsure what to do, focused practice can help. If they know the right step and an approval rule prevents them from taking it, the process owner has a specific rule to review.

References

Beautement, A., Sasse, M. A., & Wonham, M. (2008). The Compliance Budget: Managing Security Behaviour in Organisations. Proceedings of the 2008 Workshop on New Security Paradigms, 47–58. 10.1145/1595676.1595684.

Cybermalveillance.gouv.fr. (2026). What to do about payment transfer fraud or fake bank details. French-language guidance updated October 14, 2026.

Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C. A., Dameff, C. J., Savage, S., & Voelker, G. M. (2025). Understanding the Efficacy of Phishing Training in Practice. IEEE Symposium on Security and Privacy, 37–54. 10.1109/SP61157.2025.00076.

Lain, D., Kostiainen, K., & Čapkun, S. (2022). Phishing in Organizations: Findings from a Large-Scale and Long-Term Study. IEEE Symposium on Security and Privacy. 10.1109/SP46214.2022.9833766.

Dawkins, S., & Jacobs, J. (2023). NIST Phish Scale User Guide. NIST Technical Note 2276. 10.6028/NIST.TN.2276.

Michie, S., van Stralen, M. M., & West, R. (2011). The Behaviour Change Wheel: A New Method for Characterising and Designing Behaviour Change Interventions. Implementation Science, 6, 42. 10.1186/1748-5908-6-42.

About the author

Maxime Rabéchault is the founder and president of UNREST, a change enablement consultancy. He applies behavioral science to help organizations change how they work.