When a client fails a phishing simulation repeatedly in 2026, the MSP response is a written ladder, same-day coaching, and residual-access containment — not another stern volume email or a silent renewal surprise.
Key takeaways
- Open with the facts and the planned ladder, never a blame monologue.
- Auto-enrol a short lesson on every first and second fail before humans escalate.
- Separate individual coaching from cohort or industry-wide control gaps.
- Contain payment and admin residual risk by day three of a third fail.
- Put repeat-fail contacts on a 90-day watch and into the next QBR scoresheet.
Why this matters
MSPs sell security awareness as a managed control. When the same end user clicks three times, the client contact either thinks the product is broken or that their staff are hopeless. Neither is productive. Verizon’s 2026 DBIR still puts the human element in 62% of breaches. ASD’s ACSC recorded phishing in 60% of incidents handled in FY2024–25. A professional response keeps the commercial relationship and reduces residual risk at the same time.
If you improvise every fail call, you get inconsistency, friction and renewals that die on feeling. Write the play once, run it every time.
What you will need
- A four-tier escalation table the client signed at onboarding
- Platform auto-enrol for failed phishing simulations into a short lesson
- Named client sponsor and HR or people-ops path for Tier 2 and above
- Ability to tag high-risk seats in human risk reporting
- Access to short story-based microlessons under ten minutes
- A QBR one-pager that shows fails closed, not only seats trained
- Thirty minutes blocked the same day a third fail lands
The steps
1. Confirm the fail is real before you escalate
Check delivery logs: did the mail land, was it a preview-pane auto-fetch, was the template broken, was the user on leave redirected? Void false fails in writing. Only real clicks or unsafe submits advance the ladder.
Why it matters: A false third-strike wrecks trust and trains people to ignore the programme.
Expected outcome: Fail status confirmed or reversed within one business day.
Common mistake: Forwarding a raw click report to the MD without checking the campaign delivery path.
2. Short, same-day coaching on fail one and two
On first fail, auto-open the matching lesson and send a calm branded note that explains the lure. On second fail inside 90 days, CC the manager with a four-line script: what happened, why it worked, what to do next, how reporting is the win. No sarcasm.
Use short security awareness training paths so remediation finishes on the same shift for desk and hybrid staff.
Expected outcome: 100% of first fails closed with a lesson inside 48 hours.
Common mistake: Waiting for the monthly PDF before anyone coaches.
3. Tell the client sponsor the ladder, not the labels
When a user heads to Tier 2, brief the sponsor with counts and role risk, not a public shame list. Reference the onboarding ladder the client already approved. Offer the exact access groups you will pause if the person can move money or reset identity.
Expected outcome: Sponsor written acknowledgement of Tier 2 within 24 hours.
Common mistake: Shocking the client with a termination request on the second click.
4. Contain residual privilege while coaching continues
On a third fail in 180 days — or sooner for payment and admin — pause the high-risk groups until lesson completion and a manager fitness note. Keep mailbox. Contain the blast radius, not the employment relationship by default.
Expected outcome: Privileged residual risk off the air the same day as Tier 2 entry.
Common mistake: “Watching them closely” with full wire authority still live.
5. Look for control design problems, not only people problems
If an entire finance pod fails the same invoice lure, fix template difficulty ramp, MFA friction and callback process, not twelve individual prosecutions. Run a brief gap assessment mindset against people controls around payments when patterns cluster.
Expected outcome: Cluster analysis attached to any row with three-plus fails in one department.
Common mistake: Treating a broken dual-control process as twelve dumb humans.
6. Put the person on a 90-day watch with clear exit criteria
Exit Tier 2 when lessons complete, one clean follow-up sim clears, and the manager signs the fitness note. Track days-on-tier in the human risk view so nobody stays restricted forever without review.
Expected outcome: Dated exit or next review on every Tier 2 seat.
Common mistake: Permanent shadow bans nobody documents.
7. Surface repeat fails in the next QBR without theatre
Show: cohort click rate, report rate, number on each tier, average time-to-close, and residual high-privilege open items. Celebrate report-rate gains next to click drops. Keep names inside the client HR path unless the client asks for a sealed appendix.
Expected outcome: One QBR slide the client can defend to their board.
Common mistake: A dump of 200 clicker names that kills the meeting.
8. Know when to escalate commercially
If the client refuses any ladder, refuses containment for payment seats, or demands you disable simulations entirely after noise, document residual risk in writing and revisit scope at renewal. Managed people-risk without authority is not a control you should warrant.
Expected outcome: Written residual-risk note filed when the client blocks the ladder mid-flight.
Common mistake: Quietly stopping sims so the next insurer pack still claims continuous testing.
Troubleshooting
Client wants public leaderboards of worst clickers. Refuse. Offer cohort averages and private coaching paths — public shame kills report culture.
Union or works council blocks named data. Share tier counts only; keep names inside manager and HR views under their policy.
VIP fails twice and leadership wants a free pass. Title does not rewrite the ladder. Contain privilege the same way.
Fails spike after a filter change. Pause scoring while you validate delivery; void the window if templates never reached real inboxes.
Client compares you to a free annual video. Point to current residual risk numbers and insurer language, not feature colour.
Your techs freestyle every fail call. Print the ladder and the manager script; run a 20-minute internal drill.
Tools and resources
- Phishing auto-enrol and fail tags
- Human risk filters by client and tier
- Onboarding-signed escalation one-pager
- Manager script card for Tier 1 talks
- Access runbook for Tier 2 payment and admin groups
What to do next
Today: confirm your top ten clients have a signed ladder and auto-enrol switched on. This week: clear every open second-fail without a lesson. At the next renewal pack, show closed tiers next to click trends. For multi-tenant white-label playbooks that make this repeatable, use the compare notes before you rebuild the process in spreadsheets.
FAQ
How should an MSP respond when a client fails a phishing simulation repeatedly in 2026? Validate the fail, coach on one and two with auto lessons, contain privilege on three, brief the sponsor with the pre-agreed ladder, and put the contact on a dated 90-day watch.
Should repeat clickers be fired? Not by default. Contain access and use HR performance only after repeated fails or a real-incident pattern.
How fast should remediation start? Same day for the microlesson; manager talk inside five business days on fail two.
What if the whole department fails? Treat it as a control design and pretext issue first; fix ladder difficulty and payment process before individual escalations pile up.
Do reporters ever enter the ladder? No. Reports are wins. Only clicks or unsafe submits count.
How do you keep the client commercial relationship? Use the ladder they signed at kickoff, keep tone coaching-first, and show closed risk in the QBR instead of surprise blame.
What belongs in the QBR slide? Click trend, report rate, headcount per tier, time-to-close, and open high-privilege residual items.
Can small MSPs run this without a full SEC team? Yes. A one-page ladder, platform auto-enrol and a weekly tally cover most books under a few thousand seats.
One last thing
The quiet failure mode is a witty gotcha screenshot in the group chat and no lesson assigned. If your 2026 response cannot show that the second fail already completed coaching before anyone discussed HR, you are not managing human risk — you are collecting embarrassing anecdotes. Run the ladder you wrote, close the lesson same day, and protect the access that still moves money.