What if the weakest link in your company’s security isn’t a server or a firewall, but a person who just clicked a link they shouldn’t have? That’s the uncomfortable truth behind most breaches. Phishing remains one of the top ways attackers get a foothold, and the Verizon Data Breach Investigations Report has repeatedly placed phishing and pretexting among the leading initial access vectors. A phishing simulation is how security teams find out who would click before a real attacker does. (What is spear phishing) (Phishing)
But here’s the catch: setting one up badly is worse than not running one at all. A clumsy simulation can damage trust, create legal headaches, and teach employees nothing except how to resent the security team. This guide walks through how to set up a phishing simulation the right way, from the first planning meeting to the metrics you report to leadership. (Horse Racing Board Game: Family Racing Game Set)
Start With the Goal, Not the Tool
Most failed simulations begin with someone buying a platform and hitting “launch.” The better order is reversed. Before touching any software, the team needs to answer a simple question: what behavior are we trying to improve?
There are usually two answers. The first is reducing click rates on suspicious messages. The second, and often more valuable, is increasing report rates, meaning employees flag suspicious emails to the security team instead of clicking or deleting them silently. A program that drives clicks down but leaves reporting flat has only solved half the problem, because unreported phishing attempts still sit in inboxes.
Write down the goal, the target audience, and a rough timeline. A baseline phase, a training phase, and a measurement phase are enough to start. Keep the first cycle small, perhaps one department or a few hundred users, so mistakes stay contained.
Get Legal, HR, and Employee Representatives on Board Early
This step gets skipped constantly, and it’s the one that causes the most pain. Phishing simulations process employee personal data and can look like monitoring, which means the rules differ sharply by country.
In the European Union, simulations that handle personal data generally fall under the General Data Protection Regulation (GDPR). Whether you rely on consent or legitimate interest is genuinely contested, and some data protection authorities have scrutinized workplace simulations closely. In Germany, the monitoring aspects can trigger co-determination rights under the Works Constitution Act, meaning the works council may need to approve the design. The UK’s Information Commissioner’s Office has published guidance treating simulations as a security measure that can be permissible under legitimate interests when they are proportionate and transparent.
The practical takeaway is simple: talk to legal counsel and HR in your jurisdiction before the first email goes out. Explain what data you’ll collect, who sees it, and how long you keep it. A short written policy that employees can read beats a surprise.
Choose a Platform That Fits Your Team
There’s no shortage of options. Commercial platforms like KnowBe4 and Proofpoint bundle template libraries, landing pages, and reporting dashboards. GoPhish is a widely used open-source alternative that gives full control but requires more setup and hosting care.
The table below summarizes the trade-offs practitioners typically weigh:
| Factor | Commercial platform | Open-source (e.g., GoPhish) |
|---|---|---|
| Setup time | Fast, guided | Slower, self-hosted |
| Template library | Large, maintained | Basic, you build your own |
| Reporting | Built-in dashboards | Manual queries |
| Cost | Subscription | Free, but staff time |
| Control | Vendor-defined limits | Full control |
For a first program at a mid-sized company, a commercial tool usually wins on speed. For a security team with engineering capacity and tight budgets, open source works well. Either way, check that the platform supports safe landing pages that never ask for real passwords and that it can suppress sending to high-risk roles.
Build Realistic but Safe Templates
The best simulations mirror the phishing that actually reaches your inbox. Pull real examples from your mail gateway, strip out anything dangerous, and rebuild them as templates. Common themes include fake password expiry notices, shared document links, and delivery notifications.
A few rules keep this ethical and effective. Never collect credentials on a landing page; use an educational page instead. Avoid impersonating a real colleague by name. Skip anything that plays on layoffs, health scares, or personal tragedy, because those erode trust fast. And keep the difficulty curve sensible: start with obvious red flags, then introduce subtler lures as awareness grows.
This is also where a little realism about human nature helps. People click because they’re busy, not because they’re careless. Templates that respect that reality, and training that follows immediately, land much better than gotcha emails designed to embarrass.
Run a Baseline Before You Train Anyone
You can’t prove improvement without a starting point. The baseline simulation sends a single, moderate-difficulty campaign to the target group without any prior warning beyond a general policy notice. Record two numbers: the click rate and the report rate.
Resist the urge to name and shame. Individual results should go to the person and, in aggregate, to management. Publishing a leaderboard of “worst clickers” is a classic mistake that turns a learning exercise into a punishment and drives reporting down, not up.
For teams also hardening their broader security posture, the same discipline applies elsewhere. Understanding what phishing is and how to recognize it, or how spear phishing targets specific people, gives employees language to describe what they’re seeing. It’s worth pairing simulation rollouts with plain-language awareness material rather than jargon-heavy slides.
Deliver Training at the Moment of the Click
The single highest-leverage design choice is what happens right after someone clicks. Instead of a generic “you failed” screen, show a teachable moment: a short page explaining the specific red flags in that email. Then follow up within days with a brief module, not a 45-minute course.
Timing matters more than length. Training delivered minutes after the click sticks far better than training scheduled for the next quarter. Keep modules under ten minutes and make them practical: how to check a sender address, how to hover over a link, how to report in two clicks.
Make reporting frictionless. A dedicated report button in the email client, or a forwarding address that’s easy to remember, removes the biggest barrier. If reporting takes five steps, people won’t do it, no matter how good the training is.
Measure the Right Metrics
Click rate gets all the attention, but a mature program tracks several numbers together. Here’s what to watch:
- Click rate: the share of recipients who clicked a link.
- Report rate: the share who flagged the message. This should climb steadily.
- Credential submission rate: for simulations that include a fake login page, how many entered data.
- Time to first report: how quickly someone flags a campaign. Faster is better.
- Repeat clickers: the small group who click every time and need targeted coaching.
Track these over multiple cycles, not a single campaign. One simulation is a snapshot; a trend line is a story. Leadership responds to trends, and so do budgets.
Iterate, Then Scale
After the first cycle, review what worked. Did the templates feel too easy or too hard? Did training completion lag? Did the report button get used at all? Adjust and run again, gradually widening the audience and increasing difficulty.
Keep the program transparent over time. Tell employees, in general terms, that simulations happen and why. Many organizations publish an annual summary of results. That openness builds the trust that makes people willing to report mistakes instead of hiding them. (Cyber Threats and Advisories)
There’s a broader lesson here that applies to any awareness effort. Just as a family game night teaches rules through play, a good simulation teaches security through safe practice. The point was never to trick people. It was to build a reflex. (Rules for Backgammon Board Game: How to Set Up and Play)
Common Mistakes and What Works Instead
Practitioners see the same errors again and again. Here’s a quick comparison:
| Mistake | Better approach |
|---|---|
| Surprise campaign with no policy | Announce the program, explain the purpose |
| Shaming individual clickers | Coach privately, report only aggregates |
| Fake login pages collecting real passwords | Educational landing pages only |
| Training weeks after the click | Immediate teachable moment |
| Measuring clicks only | Track report rate and time to report |
| Running once a year | Short, regular cycles |
The through-line is respect. Employees who feel set up will disengage. Employees who feel equipped will report.
A Note on Evidence and Expectations
Academic evidence on whether simulations reduce real-world susceptibility is mixed: some evidence supports short-term improvement in spotting lures; other evidence questions whether that skill transfers to real attacks. NIST’s awareness and training guidance, including SP 800-50 and the controls in SP 800-53, treats simulations as part of a broader awareness program rather than a standalone fix. ISO/IEC 27001:2022 includes awareness and training controls that simulations commonly support.
In other words, a simulation is a diagnostic and teaching tool, not a magic bullet. Pair it with technical controls like email filtering and multi-factor authentication, and treat the human program as one layer among several.
Conclusion
Setting up a phishing simulation is less about software and more about sequence. Define the behavior you want to change, clear it with legal and HR, pick a platform that fits your capacity, build safe and realistic templates, establish a baseline, train at the moment of the click, and measure reporting as carefully as you measure clicking. Do that, and the program earns trust instead of burning it. Skip the boring parts, and you’ll get a spike in clicks, a drop in morale, and a very awkward meeting with your works council. The careful path takes a few extra weeks and pays off for years.
Frequently Asked Questions
Is it legal to run phishing simulations on employees?
In most jurisdictions it can be legal, but the requirements vary. Under the GDPR, simulations that process personal data need a lawful basis and often a data protection impact assessment. In Germany, works council co-determination may apply. The UK’s ICO has treated proportionate, transparent simulations as permissible under legitimate interests. Always confirm with local legal counsel before launching.
How often should a company run phishing simulations?
Most programs run short cycles every one to three months rather than one big annual campaign. Frequent, smaller simulations produce better trend data and keep awareness fresh. The exact cadence should match your risk profile and staff capacity to deliver follow-up training.
Should simulations ever use fake login pages?
They can, but the page must never collect real credentials. A safe design shows an educational message instead of a working form. Collecting actual passwords creates a serious security and privacy risk and undermines trust in the program.
What is a good click rate for a phishing simulation?
There’s no universal benchmark, because difficulty, audience, and template realism vary widely. The more useful target is improvement over your own baseline, plus a rising report rate. A program where clicks fall and reports rise cycle over cycle is working, regardless of the absolute number.
How do you measure whether a simulation actually works?
Track click rate, report rate, credential submission rate, time to first report, and repeat clickers across multiple cycles. Report rate is often the best signal, because it shows employees are actively partnering with the security team rather than just avoiding clicks.
What should happen right after an employee clicks a simulated phish?
Show an immediate teachable moment explaining the specific red flags, then assign a short follow-up module within days. Coaching should be private and constructive. Public shaming drives reporting underground and defeats the purpose of the exercise.
