Phishing is still one of the most common ways attackers get in. Phishing simulations, where you send realistic but harmless test emails to staff, can reduce that risk. Run badly, they create resentment and teach people to hide mistakes. Run well, they build a team that spots and reports attacks.
Principles that make simulations work
- Get leadership buy-in first, and include leaders in the campaigns. Executives are prime targets.
- Tell staff that simulations will happen, without saying when. The aim is awareness, not surprise.
- Teach at the moment of the click. A short, friendly landing page explaining the warning signs works better than a later email.
- Never shame individuals. No public leaderboards of who clicked. Share results by team or department.
- Make reporting easy with a one-click "report phishing" button, and thank people who use it.
- Avoid cruel lures. Fake bonuses, layoffs or health scares damage trust in the security team.
What to measure
- Report rate: the share of people who reported the email. This is the most important number. It should rise over time.
- Time to first report: how quickly someone flags it. In a real attack, early reports let you block the email for everyone else.
- Credential submission rate: more meaningful than click rate, since clicking alone is often harmless.
- Trends by department: where extra training would help most.
A sensible rhythm
Run a campaign every month or two, vary difficulty and themes (invoices, file shares, delivery notices, password resets), and pair simulations with short training sessions. Include the techniques attackers actually use now, like QR-code phishing and fake login pages for Microsoft 365 or Google Workspace.
Technical controls matter too. Phishing-resistant MFA (passkeys or security keys) and email authentication (SPF, DKIM and DMARC) stop many attacks before training is even tested.
We run phishing simulations and awareness training built on these principles, with reports by department. Request a quote.