Makwa Global: Behavior-Driven Phishing Awareness for a Federal Workforce
How a tribal enterprise federal contractor strengthened the human layer of cyber defense through quarterly phishing simulations and behavior-driven training — reducing click rates, increasing reporting, and turning awareness into an operating discipline.
Headline Outcomes
Four measurable results that defined the engagement — across click behavior, reporting culture, and operating cadence.
Reduced click rates across quarterly simulations as awareness compounded over time.
Workforce shifted from silent victims to active reporters of suspicious messages.
Recurring simulations and training built lasting behavioral change, not one-time spikes.
Awareness program aligned to the realities of handling CUI in federal contracting.
A Hardened Environment Still Had One Open Vector — People
Makwa Global’s Microsoft 365 GCC High environment was already sovereign, hardened, and operating with a measurable Defender Secure Score discipline. Identity was enforced. Endpoints were protected. Collaboration risk was managed. By every technical measure, Makwa’s posture had matured significantly.
But the most resilient federal contractors recognize a hard truth: the technical layer can only protect so far. The human layer — every employee, every inbox, every decision to click or not click — remains the highest-frequency entry point for phishing, credential theft, and business email compromise. For a workforce handling Controlled Unclassified Information (CUI), a single click can cascade into a contract-altering incident.
Annual awareness training — the industry default — wasn’t going to be enough. Compliance-driven, click-once-a-year programs don’t change behavior. What Makwa needed was a structured, behavior-driven awareness model: recurring phishing simulations, scenario-based training, and a measurable cadence that turned awareness into an operating discipline rather than a checkbox.
Why Annual Awareness Training Wasn’t a Defense — Just a Compliance Artifact
For a federal contractor handling CUI, leaving the human layer to annual training is leaving the most-targeted vector understaffed. Without a structured behavior-driven program, Makwa faced four concrete consequences:
Phishing as the Open Front Door
Phishing remains the #1 initial access vector across regulated industries — and a hardened environment with an untrained workforce still leaves the highest-frequency vector wide open.
Silent Victims, Not Active Reporters
Without a culture of reporting, suspicious messages go unflagged — turning the workforce from a sensor network into a silent gap in the detection chain.
Once-a-Year Training Decays Fast
Behavioral research is consistent: annual awareness training shows steep decay within weeks. Compliance is satisfied; defense is not.
CUI Exposure From a Single Click
In a federal contracting environment, a single successful phishing event can cascade into credential theft, lateral movement, CUI exposure, and contract-altering reporting obligations.
A Cyber Watchtower-Led, Behavior-Driven Phishing Awareness Program
Jadex Strategic Group delivered the engagement through its Cyber Watchtower platform — applying a structured, behavior-driven awareness model that pairs quarterly phishing simulations with targeted training, measurable reporting, and a sustained operating cadence that turns awareness into a defended layer.
Workforce Baseline and Scenario Design
Baselined Makwa’s workforce phishing susceptibility, designed scenario templates aligned to the realities of federal contracting (vendor invoices, contract notifications, leadership impersonation), and segmented the workforce for targeted training.
Quarterly Phishing Simulations
Launched recurring, quarterly phishing simulations — using realistic, scenario-driven payloads that mirror current adversary tradecraft rather than generic templates, and tracking click, report, and behavior metrics over time.
Behavior-Driven, Just-in-Time Training
Delivered short, focused training immediately after a click — connecting the moment of the mistake to the moment of the lesson, and reinforcing reporting as the right behavior even when the message slipped past judgment.
Reporting Culture and Tooling Reinforcement
Reinforced reporting behavior through visible recognition, easy-to-use report-message tooling integrated with Outlook, and feedback loops that closed the gap between “I reported it” and “here’s what happened next.”
Quarterly Reporting and Continuous Tuning
Delivered quarterly reporting to Makwa leadership — click trends, report trends, susceptibility segmentation, and scenario design tuning — turning awareness from a project artifact into a measurable, continuously-tuned defense layer.
Lower Clicks, Higher Reporting, and a Workforce That Defends Itself
The Cyber Watchtower behavior-driven phishing awareness program turned Makwa’s federal workforce from a quiet target surface into a measurable, active layer of defense — with quarterly evidence and a sustainable operating cadence.
Reduced Phishing Click Rates
Quarterly simulation data documented declining click rates across Makwa’s workforce — evidence that awareness was changing behavior, not just satisfying training requirements.
Higher Reporting Behavior
Workforce reporting of suspicious messages increased measurably — turning the federal workforce into a distributed sensor network that contributes to detection rather than gaps in it.
Behavior-Driven, Not Compliance-Driven
Awareness shifted from an annual check-the-box exercise to a behavior-driven discipline — with just-in-time training, scenario realism, and measurable feedback loops.
Federal-Workforce Realism
Scenario design reflected the realities of federal contracting — vendor invoices, contract notifications, leadership impersonation — so the training matched the threat model Makwa actually faces.
A Sustained Operating Cadence
Quarterly simulations, training, and reporting are now built into how Makwa operates — eliminating the awareness decay that plagues annual-only training programs.
Leadership-Ready Reporting
Quarterly reporting gives Makwa leadership defensible evidence of human-layer maturity — supporting federal contract conversations, SPRS posture narratives, and internal risk reviews.
Our technical layer was strong. The human layer was the gap we couldn’t close with technology alone. Quarterly simulations and behavior-driven training turned our federal workforce from a silent target into a measurable, active layer of defense.
Turn Awareness Into an Operating Discipline, Not a Compliance Artifact.
Like Makwa, your technical posture may already be strong — but the human layer is where most breaches start. Cyber Watchtower builds behavior-driven phishing awareness into a quarterly operating cadence that closes the gap between annual training and real-world resilience.