Verona Area School District Doubles Staff Phishing Reports with Tartan Gamification

About Verona Area School District

The Verona Area School District is located just west of Madison, Wisconsin. The district serves around 5,600 students across 10 schools, with just over 1,000 staff, and runs on Google Workspace.

Jason Rubo is the district's Director of Technology and Digital Learning and is in his fifth year in the role. He works alongside Network Manager Dan Wang to run Verona's phishing program.

Challenge: A Phishing Program That Took Too Much Time

Verona has run a gamified phishing program for years. Staff who reported phishing emails were entered to win prizes, and the program helped bring the district's phishing rate down. But the previous vendor didn't give Jason's team the tools to build phishing emails that would reach inboxes without being flagged by Google, so the team ended up building their own.

"We have been doing our own homebrewed version of gamification, and this has been influential in our phishing rate going as low as they have over the years. The problem was that everything created entirely by us for every campaign took precious time away from our other responsibilities in the district."

Responding to reported emails was manual too. Jason was emailing every staff member who reported a suspicious email to thank them, and removing a real threat meant leaving the phishing tool and working in the Google Admin console.

Solution: Set It and Forget It

Verona trialed Tartan in March 2026 and signed a three-year agreement. Tartan's simulations land directly in staff inboxes, so the team no longer has to build its own emails or work around Google's filters.

"Now, we can set it and forget it with our campaigns, and respond to emails flagged as phishing."

The district synced its staff from Google Workspace and rolled out:

• Phishing simulations delivered directly to inboxes, including Google-themed scenarios staff see every day
• The Tartan Shield report button in Gmail, so staff can report a suspicious email in one click and IT sees it right away
• Threat Manager to review reported emails and move real threats to spam or permanently delete them from every inbox
• Points and leaderboards that reward staff for reporting phishing

"We have already established some of our gamification with a previous product, but the ease of use of Tartan's system and the direct mail injection have taken it to the next level."

Gamification: Points, Prizes, and Swedish Fish

In Tartan, staff earn points for reporting both real phishing emails and simulations. Once IT reviews a report and marks it as phishing, spam, or safe, the person who reported it gets an email letting them know the outcome.

"The points system, when they report both emails that are phishing and the simulated ones, has bumped the use of the button to report exponentially. It is also great knowing that when we look at the email and determine if it is phishing/spam or not, the user gets the email report back, letting them know."

Verona pairs the points with real prizes.

"Our users who report a phishing email in our campaigns become eligible to win a variety of prizes, including Swedish Fish candies, fun stickers, and even T-shirts from the technology department. We plan to expand this with the leaderboard and also award the top 5 on it after a semester with some other cool swag!"

Staff have embraced it.

"They love the expansion of our gamification and seeing where they stack up on the leaderboards."

Results: Faster Response to Real Threats

With reporting, review, and removal in one place, Jason and Dan can act on a reported email without switching tools.

"The use of the button, the response the user gets back after we verify, and the ability to quarantine right from the platform, as opposed to leaving and jumping into Google Admin Console, have made our response times even better!"

Since the Tartan Shield went live in July 2026:

• 152 Suspicious Email Reports: Staff have reported real emails with the Tartan Shield button.
• Reporting Keeps Growing: Reported emails grew from 23 in August to 51 in September as staff got used to the button.
• 86 Threats Removed from Inboxes: Jason and Dan moved 86 reported threats to spam or permanently deleted them directly from Tartan.

What It's Been Like Working with Tartan

For Verona, Tartan has been a partner that listens. The features Jason and Dan rely on most today, like the automatic reply staff get after reporting an email and moving threats to spam or deleting them without leaving Tartan, came out of their feedback during the trial and launched with Threat Manager in July. Smaller fixes they suggested, like case numbers in report notifications and a clearer Shield icon in Gmail dark mode, followed within weeks.

That experience is why Jason now recommends Tartan to other districts and serves as a reference for those considering it.

Advice for Other Districts