How to run a phishing simulation that teaches rather than punishes

Phishing is the most common way attackers reach a company, and it works because it targets people, not software. Technical defences catch a lot, but some messages will always get through to an inbox. A phishing simulation lets you find out how your own people respond, safely, and then do something about it.

This guide sets out how to run one in a way that improves security without damaging trust.

What a simulation is

A simulation is a planned exercise in which you send realistic but harmless phishing messages to your staff. When someone clicks a link or enters details on a fake page, the system records it and shows them an explanation. You then use the aggregate results to decide what training is needed.

It is not a trap, a test of loyalty or a way to find someone to blame. Its purpose is to build the habit of pausing before acting on an unexpected message.

Step 1: Set clear goals

Decide what you want to learn:

• which kinds of message are most likely to fool your people
• which teams or processes are most exposed, such as finance, HR or the help desk
• whether people know how to report a suspicious message, and do
• whether training changes behaviour over time

Write the goals down and agree them with senior management and HR before you begin.

Step 2: Tell people how it works, in general terms

Staff should know that simulations are part of your security programme, why you run them and what will happen with the results. Be explicit that individuals won’t be named or disciplined. Don’t give away the date or content of each exercise, or you’ll measure how people behave when warned, not when surprised.

Step 3: Design realistic scenarios

Base scenarios on the tactics attackers actually use:

• A spoofed sender, such as a message that appears to come from IT, HR or a supplier.
• Urgency, such as a prompt to confirm an account or reset a password before a deadline. (Real password resets are never requested by email links, and your training should say so.)
• A fake login page that looks like a company or cloud-service sign-in.
• A payment or invoice request that mimics a supplier, for finance teams.
• A shared-document notification, a very common way in.

Vary the difficulty. Some messages should contain obvious clues and others very few. Keep scenarios fair and avoid topics that would cause real distress, such as fake bonuses, redundancy notices or health information.

Step 4: Choose who and how

Start with a mixed group, and include leadership, who are frequent targets. Stagger the sending, so people can’t warn each other, and tell your help desk and security contact in advance so that real reports can be told apart from the exercise. Use a reputable simulation tool that handles sending, tracking and the learning page, or have a security adviser run it.

Step 5: Capture the right measures

• Click rate: who followed the link.
• Credential entry rate: who typed details into the fake page. This is the more serious signal.
• Report rate and speed: who flagged the message, and how quickly. This is the behaviour you most want to grow.
• Repeat outcomes by team or type of message, looking at patterns, not individuals.

Look at the trend over several rounds. A falling click rate and a rising report rate is the sign of a healthier culture.

Step 6: Teach straight away

The moment after a click is the best time to learn. Show a short, friendly page that points out what to look for, for example the mismatched sender address, the unusual urgency and the link that didn’t match its label. Then follow up with brief training for the whole organisation covering the red flags the results revealed, and the reporting route.

Step 7: Communicate the results openly

Share the overall findings with everyone: what the exercise showed, what the common clues were and what you will do next. Leaders should talk about it candidly, including admitting that they too have been caught out. Thank those who reported. A culture where people say “I clicked something odd” quickly is worth far more than one where people hide it.

Step 8: Repeat, vary and improve

Run simulations regularly, such as quarterly, with different scenarios each time. Use the results to adjust training, to check that processes such as payment confirmation work, and to decide whether technical controls like email filtering need tightening. If one team struggles, offer help rather than pressure.

Common mistakes

• Using it to shame or punish. People stop reporting, which is the opposite of what you want.
• One-off exercises. A single test teaches little. A rhythm builds habits.
• Unrealistic or unfair scenarios. Ones that no one could be expected to spot teach nothing; ones that exploit real distress damage trust.
• Ignoring the report rate. Click rate alone encourages people to avoid clicking anything and to stop reading mail.
• Forgetting the wider defence. Simulations complement, and don’t replace, multi-factor sign-in, email filtering, backups and a response plan.

Where to go next

Our guides to basic cybersecurity practices and common threats put simulations in context. If you’d like help designing and running a programme tailored to your organisation, you can talk to us.