Buying Support and Building Resilience: Define the Contribution

Separate procurement from capability

An organization can purchase a platform, a training module or external support. A purchase can make a resource available, but its contribution to resistance, coping or cooperation depends on the conditions of use and how the organization incorporates it into its work.

I therefore consider the intended contribution more important than the product label. A dashboard can bring information together. Who draws decisions from it, what authority they have and how implementation is followed through still need to be established.

What a specific phishing study examined

Grant Ho and colleagues’ “Understanding the Efficacy of Phishing Training in Practice” (IEEE Symposium on Security and Privacy, 2025) examines ten simulated phishing campaigns over eight months at UC San Diego Health, involving more than 19,500 employees. The authors study mandatory annual security awareness training and different embedded learning offers displayed after a user clicks a simulated phishing link.

For annual training, they find no significant association between recent completion and lower susceptibility in the simulations. For embedded training, the controlled comparison finds a statistically significant benefit for the training groups, but the absolute difference remains small. For certain static content, completing more training sessions is also associated with worse subsequent outcomes.

The study concerns these training formats and clicks on simulated phishing links. It does not establish the effectiveness of every training approach or measure organizational resilience as a whole. For procurement, it illustrates why attendance and completion alone do not demonstrate the desired change in behavior.

Specify the organizational contribution

Resistance concerns preventing and limiting disruption. Coping capability concerns action when existing protection is exceeded. Cooperation capability concerns working with actors whose knowledge, resources or decisions the organization needs.

Information can support all three. Its application also requires clear responsibilities, available resources and practised ways of working. Training on cooperation, for example, does not replace agreement about the assistance a partner can actually provide.

Base the purchase on an assessable task

Before selecting an offer, I recommend specifying which task should be performed differently after implementation. Establish what the offer contributes and which internal work remains. A trial can show whether the intended roles can use the new resource under the conditions being considered.

This does not diminish external services. It makes their value easier to assess by connecting the purchase with a specific development need. Responsibility for organizational integration and decisions about remaining gaps stays with the client.

Source: Ho et al., “Understanding the Efficacy of Phishing Training in Practice”, 2025, especially Sections 3, 4.2, 5.2, 6.2 and 8.

→ Developing resilience capabilities: Services → The conceptual model: Approach