Ask whether the security training your team dreads every quarter makes your company more vulnerable. That question frames the phishing simulation debate. A fake phishing campaign run poorly teaches employees to fear the security team and to click “report” only when a prize is dangled. Run well, it is one of the cheapest and most effective ways to harden an organization against real attacks. The difference between those outcomes comes from the practices behind the tool, not from the tool you buy. (Ai governance principles risks and best practices)
This guide walks through what actually works in practice, where common programs go wrong, and how to build a simulation program that people respect rather than resent.
Why phishing simulations still matter
Phishing remains one of the most reliable ways attackers get a foot in the door. The Verizon Data Breach Investigations Report (DBIR) has consistently ranked phishing among the top initial-access vectors year after year, and the Anti-Phishing Working Group (APWG) tracks hundreds of thousands of unique phishing attacks each quarter in its Phishing Activity Trends Reports. Those numbers move with every edition, so always cite the specific report year rather than a single figure repeated forever. (What is spear phishing) (Phishing)
The practical takeaway is stable: attackers keep using email and messaging lures because they work. Simulations exist to give employees a safe place to make mistakes before a real attacker exploits them. For a deeper look at how these attacks operate, see a primer on what phishing is and how to recognize it.
It also helps to be precise about what you are simulating. Most programs lump everything under “phishing,” but spear phishing, a targeted attack using personal details, requires different training than a generic mass lure. If your program does not distinguish the two, employees may pass easy tests and still fall for a tailored message. A good primer on what spear phishing is worth sharing with staff before you run targeted simulations. (What is phishing and how can you recognize it)
Start with a documented program, not a tool
NIST Special Publication 800-50, published in October 2003, remains NIST’s foundational guidance on building an IT security awareness and training program. Most credible simulation programs map their structure to it: define the audience, set learning objectives, deliver training, and evaluate results. NIST’s SP 800-53 control family AT-2 (Literacy Training and Awareness) is the control most organizations cite when auditors ask why simulations exist at all.
In practice, the organizations that get this right write a short program charter before launching anything. It covers:
- Objectives: what behavior you want to change (reporting speed, rather than click rate alone)
- Scope: who gets simulated, how often, and which channels (email, SMS, voice)
- Governance: who approves lures, who reviews results, who sees individual data
- Escalation: what happens when someone clicks repeatedly
- Review cadence: when the program itself gets audited
That charter takes a few hours to write and prevents most of the problems described below.
Get legal, HR, and works councils involved early
This is the step people skip, and it is the one that causes the most pain. In some jurisdictions, employee monitoring rules and works-council consultation requirements (Germany is the classic example) apply directly to phishing simulations because you are collecting behavioral data on individuals. Labor law varies widely, so verify locally rather than assuming.
The common mistake is treating this as a formality after the first campaign has already run. Instead, brief HR and legal before the pilot, agree on what data is retained and for how long, and decide in advance whether managers see individual click results or only aggregate trends. Many mature programs default to aggregate reporting plus individual coaching delivered privately, never a public leaderboard.
Design lures that teach, not humiliate
The lure is where programs live or die. A few principles hold up across industries:
- Stay realistic but not cruel. Use lures that resemble real threats your organization actually sees, such as fake delivery notices, password expiry prompts, or shared-document alerts.
- Avoid high-stress timing. Do not run campaigns during payroll week, major layoffs, or end-of-quarter crunch. Clicks during those periods measure stress, not vigilance.
- Never mimic real internal systems too closely. A lure that perfectly clones your actual password-reset page trains people to distrust the genuine one.
- Keep the landing page educational. The moment after a click is the teachable moment. A short explainer on what gave the lure away beats a shaming “You failed” screen every time.
- Rotate difficulty. Start with obvious lures and increase subtlety over time so the program grows with the workforce.
A useful sanity check before launching any lure: would you be comfortable showing it to the employee’s manager and explaining why it was fair? If not, redesign it.
Measure reporting speed alongside click rate
Click rate is the metric everyone reports and the least useful one on its own. A low click rate can mean a vigilant workforce, or it can mean employees are too afraid to click anything, including legitimate links. The better metrics are:
| Metric | What it tells you | Why it matters |
|---|---|---|
| Report rate | Share of recipients who flagged the lure | Directly predicts how fast real attacks get caught |
| Time to first report | Minutes until someone reports | Shortens the window before IT can block a campaign |
| Repeat click rate | Share who clicked more than once | Identifies who needs coaching, not punishment |
| False report rate | Legitimate emails flagged as phishing | Flags over-correction and alert fatigue |
Track these over quarters, not campaigns. A single simulation is a data point; a trend line is a program. Share aggregate results openly with staff so they can see progress, and keep individual results private except in coaching conversations.
Build a blame-free reporting culture
The single biggest predictor of program success is whether employees feel safe reporting mistakes. If the first click leads to a mandatory remedial course and a note in someone’s file, the second click goes unreported, and unreported clicks are exactly what attackers rely on.
Practical steps that work:
- Thank every reporter, even when they clicked first and reported second.
- Publish a one-click report button in your email client so reporting takes seconds.
- Close the loop: tell staff what happened after a report (“that was a simulation” or “that was real, and here is what we blocked”).
- Never name individuals in company-wide communications about results.
- Reward reporting visibly, for example by recognizing teams with the fastest median report time.
This mirrors the broader principle behind good AI governance: transparency about what data is collected and why builds the trust that makes participation genuine rather than grudging.
Pair simulations with real training and technical controls
Simulations are a diagnostic, not a cure. They work best alongside three other layers:
- Short, targeted training delivered right after a click, not months later in a generic annual module.
- Phishing-resistant multi-factor authentication, which CISA has promoted extensively, so a stolen password alone cannot grant access.
- Email filtering and DMARC enforcement, which block the bulk of attacks before anyone sees them.
The UK’s NCSC has published guidance on running phishing simulations responsibly, including cautions about how campaigns are communicated to staff. The consistent theme across NIST, CISA, and NCSC material is that simulations support a security culture; they do not replace one.
The honest debate: do simulations actually work?
Not everyone is convinced. Some researchers and practitioners argue that frequent simulations can erode trust in IT and security teams, produce “security fatigue,” and train employees to treat all internal communications with suspicion. Others point to improved reporting behavior and faster response times after sustained programs.
The balanced reading is that the evidence is mixed and depends heavily on design. Vendor-published benchmarks tend to show dramatic click-rate reductions; independent academic studies are more cautious. A program that shames people will likely backfire. A program that coaches, thanks reporters, and shares aggregate progress tends to earn its keep. Present the debate honestly to leadership rather than promising a fixed percentage drop. (Cyber Threats and Advisories)
A practical 90-day rollout plan
If you are starting from scratch, this sequence avoids most of the classic mistakes:
- Days 1–15: Write the program charter, brief HR and legal, confirm any consultation requirements.
- Days 16–30: Baseline measurement. Run one easy campaign and record report rate, time to first report, and repeat clicks. Tell staff a program is starting.
- Days 31–45: Launch the one-click report button and publish a short “how to spot a phish” guide.
- Days 46–75: Run two campaigns of increasing difficulty. Deliver micro-training immediately after each click. Share aggregate results company-wide.
- Days 76–90: Review metrics, adjust frequency (quarterly is a common default), and set targets for the next quarter.
Common mistakes to avoid along the way: launching before legal sign-off, running campaigns during busy season, publishing individual click results, using lures that mimic real internal systems, and measuring only click rate. Each of these is fixable, but each one costs trust that takes months to rebuild.
Conclusion
Phishing simulation best practices come down to a simple idea: treat employees as partners in defense, not as targets to catch out. Document the program, involve legal and HR early, design fair lures, measure reporting speed rather than clicks alone, and never punish honest mistakes. Do those things and simulations become a genuine asset. Skip them and you get a program that generates resentment and data nobody trusts. The tool matters far less than the culture you wrap around it.
Frequently asked questions
How often should phishing simulations be run?
Quarterly is the most common default and a reasonable starting point for most organizations. High-risk teams such as finance or IT may benefit from monthly campaigns, while general staff can stay on a quarterly cadence. The right frequency is the one that keeps awareness fresh without causing fatigue, so review it each quarter against report rates and staff feedback.
Should employees be told they are being simulated?
Staff should know a simulation program exists, even if individual campaigns are unannounced. Announcing the program up front, while keeping specific lures secret, is the standard approach. It preserves the realism of each test while avoiding the sense of being secretly surveilled, which is what erodes trust.
Is it legal to run phishing simulations on employees?
It generally is, but the rules vary by jurisdiction and by sector. Employee monitoring and data protection laws may apply, and in some countries works councils must be consulted before behavioral data is collected. Confirm requirements with legal counsel or HR before the first campaign rather than after.
What is a good click rate for a phishing simulation?
There is no universal benchmark worth chasing. Rates vary enormously by industry, lure difficulty, and whether staff have seen simulations before. More useful is your own trend line: is the report rate rising, is time to first report falling, and is the repeat click rate shrinking over successive quarters?
What should happen when an employee clicks a simulated phish?
The best response is immediate, private, and educational: a short explainer showing what gave the lure away, plus an invitation to ask questions. Repeated clicks should trigger a coaching conversation, not discipline, unless policy violations are genuinely serious. Public shaming or punitive consequences reliably reduce future reporting.
Can phishing simulations replace security awareness training?
No. Simulations are a diagnostic tool that shows where training is needed; they do not teach the underlying skills on their own. They work best combined with short targeted training, phishing-resistant multi-factor authentication, and strong email filtering. Used together, these layers catch far more attacks than any single measure.
