Phishing Readiness and Reporting Audit
Check how staff spot and report suspicious messages.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).
Audit phishing readiness. Training materials, reporting method and results of any simulations: [PHISHING_PROGRAM]. Examples of suspicious messages received, with details removed: [EXAMPLES]. How staff are treated when they report a mistake: [REPORTING_CULTURE]. Check whether reporting is easy and fast, whether staff fear blame, whether training uses realistic examples, whether high-risk roles get extra support, and whether the response to a click is rehearsed. Avoid designing deceptive tests that humiliate staff. Return a table with Area, Finding, Risk (red, amber, green) and Action, a one-page guide for staff on what to do after clicking, and a respectful training plan. Simulation and monitoring rules are [VERIFY] for [JURISDICTION]. Also suggest how to give feedback to staff who report, such as a thank-you within a day, and how to share anonymised examples of real attempts so that training stays relevant and builds trust instead of fear. Then plan a supportive awareness programme for the next six months. Outline monthly topics based on real patterns in our own reports, such as invoice fraud, fake sign-in pages and urgent requests from executives, with a ten-minute activity for each. Provide a respectful approach to simulations if they are used: purpose, consent from leadership, no humiliation, immediate feedback and aggregate reporting only. Create a one-page guide on what to do after clicking or entering details, a simple reporting button or address, and a promise that reports are welcome. Add measures that reflect learning, such as the number of reports and the time to report, and not only click rates. Suggest how to support high-risk roles such as finance and administrators. Employment, monitoring and privacy rules are [VERIFY] for [JURISDICTION], and any real compromise should be handled through the incident plan. I will have a qualified professional verify the final findings. Present them as hypotheses with evidence, not proofs, and keep all examples generic and safe.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.