A school-district phishing campaign uses GoPhish dashboards after an authorized send. How should leaders best use the resulting click-rate data?
Select an answer to reveal the explanation.
Short Explanation
The GoPhish board is a coaching map, not a public shaming billboard. High-click groups get more practice; people still deserve private remediation. Zero clicks forever is a fairy tale—progress is the goal.
Full Explanation
After an authorized school-district phishing campaign, GoPhish dashboards should drive constructive follow-up: leaders prioritize additional awareness training for cohorts with higher click rates while protecting individual coaching privacy. Aggregate and cohort metrics identify where process or training gaps are largest; private remediation respects staff dignity and reduces retaliatory or chilling effects that undermine reporting culture. Publishing named clickers on a public district website to increase social pressure turns a learning exercise into shaming, damages trust, and can create HR and legal exposure. Ignoring metrics and assuming every campaign failed unless zero staff clicked sets an unrealistic perfection standard and wastes the diagnostic value of the simulation. Deleting campaign statistics immediately so legal never sees simulation outcomes destroys evidence of program diligence and prevents trend analysis across school years. Exam caveat: GOAA awareness-program items emphasize ethical use of phishing metrics—coach and improve, do not dox. Operational check: export cohort-level click and report rates into the awareness plan, schedule targeted refreshers, keep individual coaching confidential, and retain metrics under the district’s records policy.