<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1386548816544472&amp;ev=PageView&amp;noscript=1">

Case study

ACHN Reduces Phishing Risk by Over 50% with BrainStorm Threat Defense

ACHN case study@2x
logo-achn
Key challenges
  • Reducing human-based security risk while under constant healthcare audit and compliance pressure

  • Proving improvement with clear data, not just “checkbox” training completion

  • Engaging non-technical staff with training that actually changes behavior (previous tools were too technical/dry)

 
Key results
  • Click rates reduced from 44% to 2%

  • Open rates reduced from 53% to 19%

  • 50%+ reduction in phishing failures

  • Clear visibility into high-risk roles, enabling targeted training

Challenge

We talked with Mike Baran, CIO at Access Community Health Network about his success and challenges dealing with security threats in such a highly regulated industry and at such a volatile time in technology’s evolution.

As a healthcare organization operating under constant audit pressure, ACHN needed to reduce human-based security risk and prove it with data. While heavily invested in Microsoft security tools, they lacked a consistent and effective way to train users, measure behavior change, and identify repeat offenders.

Previous training solutions were overly technical and failed to engage non-technical staff, leaving ACHN with high phishing failure rates and limited visibility into where risk persisted.

“Our previous security training solution provider was too dry and too techy for the average user. The material wasn’t consistent in quality.”

 

Solution

ACHN deployed BrainStorm Threat Defense to deliver phishing simulations, security training, and behavioral reporting in one platform. Threat Defense enabled ACHN to:

  • Run consistent password-phishing and malware simulations
  • Track repeat offenders over time
  • Identify risk by role and title
  • Present clear, high-level metrics tied to real user behavior

“Looking at failure rates and the types of messages people fall for tells us exactly where to focus our training next.”

Results

Across 19 phishing campaigns sent to approximately 1,100 users, ACHN saw sustained improvement in security behavior.

Measured outcomes include:

  • Click rates reduced from 44% to 2%
  • Open rates reduced from 53% to 19%
  • 50%+ reduction in phishing failures
  • Clear visibility into high-risk roles, enabling targeted training

Threat Defense data also supported ACHN during audits and compliance reviews by demonstrating measurable reductions in user risk.

It was nice to be able to say this tool helped us lower failure rates."

Business impact

By combining training, simulations, and reporting into a single platform, ACHN strengthened its security posture while maximizing its Microsoft investment. Leadership gained confidence through simple, outcome-driven reporting that translated security performance into business terms.

“My favorite way to present business value is the number of people who fell for a fake scam."

Solution and offer

ACHN’s story is one many security teams recognize: people are still the easiest way for threats to get in (the human element is still involved in nearly 70% of breaches*), and leaders want proof that things are actually improving. Threat Defense is built for that reality.

Threat Defense combines realistic phishing and malware simulations, role-relevant training, and built-in reporting into a single solution. Security teams can run ongoing campaigns, track repeat offenders, and quickly see where risk is concentrated across the organization. The result is a program that’s easy to manage, easy to explain to leadership, and focused on changing behavior, not just checking a box.

To see how Threat Defense can help reduce human risk in your organization, request a demo or have a conversation with one of our representatives.