A phishing test in Canada has caused anger after healthcare workers were sent an email promising an extra paid day off.
It was not a reward – it was a test.
The email was reportedly sent to staff at Newfoundland and Labrador Health Services and framed as recognition for their hard work during a major system rollout. Staff were invited to click a link to claim the paid day off. They later found out it was part of a cyber security exercise.
The reaction was exactly what you might expect.
Healthcare workers who were already under pressure felt misled. Union leaders called it cruel and insensitive. The health board has since apologised.
This is where cyber security leaders need to pause, because yes, phishing is a real risk.
Attackers do use emotion, urgency, authority, reward and fear to make people click. A fake day off is exactly the kind of bait a criminal might use. From a purely technical point of view, you can see why somebody thought this would be a realistic test.
But cyber security does not happen in a spreadsheet.
It happens in real organisations, with real people, under real pressure.
Culture changes how people respond
A phishing simulation can be useful. Done well, it helps staff practise spotting suspicious emails in a safe environment. It shows where extra support is needed. It gives leaders useful evidence. It can start good conversations.
Done badly, it tells staff:
“We don’t trust you.”
“We are trying to catch you out.”
“Your stress is useful to us.”
That is a very different message, and once people feel tricked by their own employer, the damage is not limited to one test. They may become less likely to report mistakes. Less likely to ask for help. Less likely to engage with future training. Less likely to see cyber security as something that protects them and the people they serve.
A healthy cyber security culture is not built on humiliation. It is built on trust, clarity and shared responsibility.
People are not the problem
There is a phrase in cyber security that I dislike: “people are the weakest link.”
People are not the weakest link. People are the ones who spot strange emails, question unusual payment requests, report lost devices, challenge suspicious login prompts and stop incidents before they become disasters.
But they can only do that if the culture around them makes it safe to speak up.
If a member of staff clicks a phishing email and fears being named, shamed or disciplined, they may stay quiet. That delay can be far more damaging than the original click.
A better culture says:
“Thanks for reporting it. Let’s deal with it quickly.”
That one sentence can make a huge difference.
Realistic does not have to mean cruel
Some will argue that phishing tests need to be realistic.
They do, but realistic does not mean careless.
You can test phishing risk without exploiting exhaustion, grief, pay anxiety, job insecurity or personal hardship.
There is a line between a useful simulation and an own goal.
A fake invoice? Sensible.
A suspicious Microsoft 365 login alert? Useful.
A delivery notification? Common.
A fake HR message promising a benefit to burned-out healthcare workers? That should have been challenged before it ever left draft.
Good cyber security awareness training is not about catching people out. It is about helping people make safer decisions when they are busy, tired or under pressure.
Leadership sets the tone
Culture comes from the top.
If leaders treat cyber security as a box-ticking exercise, staff will too. If leaders treat phishing tests as a way to catch people, staff will see security as hostile. If leaders ignore workload, stress and morale, they should not be surprised when training lands badly.
The better approach is calmer and more human.
Tell staff why phishing matters.
Explain what criminals are trying to do.
Make reporting simple.
Praise people who report suspicious emails.
Use training little and often.
Test, but do it with care.
Support the people who click rather than embarrass them.
That is how you build a culture where cyber security becomes part of everyday work rather than another thing people resent.
If your phishing test creates more fear inside the organisation than the phishing email itself, the test has failed.
Cyber security should make people more confident, not more cynical.
The lesson from this story is not that phishing simulations are bad. The lesson is that culture decides whether cyber security training builds trust or breaks it.
Trust is one of the most important controls any organisation has.
