Phishing
How to run a phishing simulation (without scaring your team)
A practical, ethical playbook for launching your first simulation — from picking templates to turning every click into a coaching moment instead of a gotcha.
A phishing simulation is one of the most effective ways to measure and reduce human cyber risk — but done badly, it breeds resentment instead of resilience. The goal isn't to catch people out. It's to give them safe, realistic practice so the real thing feels familiar.
Start with a goal, not a gotcha
Before you send anything, decide what you're trying to learn. A baseline click rate? Whether finance spots invoice fraud? How fast people report? A clear goal keeps the program honest and gives you a number to improve over time, rather than a one-off 'we got 30% of them' headline.
Pick scenarios that match real risk
The best simulations mirror the attacks your people actually face. Rotate through the techniques attackers really use:
- Credential harvesting — a fake login page for a tool your team uses daily.
- Business email compromise — a spoofed request from a 'manager' or supplier.
- Attachment and QR-code lures that push past email filters.
- Seasonal hooks — payroll changes, benefits enrollment, parcel delivery.
Turn the click into a lesson
What happens after a click matters more than the click itself. Replace the 'gotcha' page with a short, supportive teachable moment: explain the specific red flags in that email, why it mattered, and how to report next time. No naming, shaming, or leaderboards of 'failures'.
Measure what matters
Click rate is a starting point, not the finish line. The metric that predicts real-world resilience is the reporting rate — how many people flag the suspicious message. Track both, segment by team, and watch the trend across several campaigns rather than obsessing over any single send.
- Click rate — trending down over time.
- Report rate — trending up over time.
- Time-to-report — your early-warning signal for live attacks.
Run simulations on a regular cadence, keep them realistic, and pair every campaign with bite-sized training. Within a few cycles you'll have a workforce that reports threats reflexively — and a number you can take to the board.