Copart: CSO Award-Winning Security Behavior Change and Engagement

Leaving Manual in the Rearview Mirror

Before the program that would eventually win a CSO Award, Copart’s cybersecurity training relied on manual processes that slowed progress and limited impact.

Campaigns were built from scratch. Content was translated manually. Reporting required navigating spreadsheet after spreadsheet just to identify trends. Training and awareness was only part of the team’s responsibilities, yet it dominated their workload.

“Training and awareness is just a subset of our role, but it was taking up 80 to 90% of our time trying to build campaigns and parse data. Hoxhunt removed almost all of that manual work to let us focus on what matters.”
— Dani Chade, Cybersecurity Engineer

Because campaign creation required so much effort, exposure was limited. The team could only send one to three campaigns per quarter, leaving employees with long stretches between learning opportunities.

It was like expecting drivers to react perfectly in an emergency after practicing safety once a year.

Copart’s leadership recognized that to improve outcomes, they needed more than incremental fixes. They needed a redesigned system—one capable of supporting long-term behavioral change at scale.

That realization set the foundation for the award-winning transformation that followed.

Installing the Right Safety Features

Partnering with Hoxhunt allowed Copart to replace manual workflows with automated, behavior-driven training—an essential step toward building the CSO Award–winning program that would later gain industry recognition.

Instead of manually steering every campaign, automation handled the heavy lifting.

Simulations were delivered automatically based on employee roles and behaviors. Micro-trainings appeared immediately after interactions, helping employees understand mistakes while the experience was still fresh. Leaderboards and achievements introduced a new element of motivation.

Security training began to feel less like paperwork and more like practice.

“When we were introduced to Hoxhunt, it was a night-and-day experience. We stopped spending time managing campaigns and started focusing on improving how people learn.”
— Dani Chade

Automation also transformed executive reporting.

Scorecards that once took days to assemble became instantly accessible dashboards. Instead of spending hours building reports, the team focused on identifying trends and working with leadership to strengthen behaviors across departments.

“Now the data is ready at the click of a button. We can focus on conversations instead of building reports.”
— Brittany Little

Engagement quickly accelerated.

Employees began tracking their rankings on live leaderboards and celebrating achievements. Some even reached out while traveling to ensure their progress remained intact.

“We’ve had employees message us from vacation asking how to pause their training because they didn’t want to lose their status.”
— Dani Chade

That kind of participation signaled something important. The program wasn’t just running. It was gaining traction—like a vehicle finally hitting the open road.

Buckling Up a Security Culture

Winning a CSO Award wasn’t just about deploying new technology. It was about building habits that stuck.

The real success of the Copart and Hoxhunt collaboration came from shifting behavior—making cybersecurity feel automatic, consistent, and familiar.

Like fastening a seatbelt.

With consistent exposure and immediate feedback, employees began recognizing threats more confidently and reporting suspicious emails more frequently. Over time, cybersecurity became less of a scheduled task and more of a daily reflex.

Recognition helped reinforce that momentum.

Leaderboards, achievements, and visible progress gave employees a sense of ownership over their performance. Departments celebrated milestones, and leadership stayed engaged through real-time scorecards.

“People care about the achievements. That recognition drives the behavior we want to see.”
— Brittany Little

The impact extended beyond the workplace.

Employees reported applying what they learned in their personal lives, identifying suspicious messages outside of work and avoiding scams.

“It literally warms our hearts when someone tells us they remembered a training and used it to protect themselves.”
— Dani Chade

That kind of cultural shift—where awareness becomes instinct—is exactly what distinguished Copart’s program and helped earn CSO Award recognition for innovation and measurable impact.

Results: A Proven Performance That Earned Industry Recognition

The results of Copart’s collaboration with Hoxhunt didn’t just improve internal performance. They demonstrated measurable outcomes strong enough to earn a CSO Award, recognizing the program as a model of innovation in cybersecurity awareness.

With Hoxhunt in place, Copart achieved:

• 202,992 completed phishing simulations
• 963 unique simulation variants delivered
• 55.1% simulation success rate
• 59.9% overall reaction rate
• Reporting rate doubled from 24% to over 50%
• New visibility into miss rates, enabling targeted behavior improvement
• Reduced failure trends over time, driven by consistent exposure

The scale of training alone represented a major breakthrough.

“We could never have imagined sending over 200,000 simulations on our own. That level of exposure completely changed the learning experience.”
— Brittany Little

As exposure increased, performance followed. Employees improved their recognition skills through repetition, and reporting behavior strengthened across the organization.

This progress gave security teams faster visibility into threats and reduced response delays.

“The more people know what to look for and when to report it, the faster we can respond and protect the environment.”
— Brittany Little

Ultimately, the numbers told a clear story. What began as a manual, time-consuming process evolved into a scalable, behavior-driven program that earned industry-wide recognition.

The CSO Award validated what Copart already knew internally: cybersecurity had shifted from an occasional reminder to a reliable habit—one employees carry with them every day, just like buckling a seatbelt before every drive.

‍