Ethical phishing simulations: how to test without breaking trust

Start with the strongest objection#

The UK’s NCSC publishes a section called "The problems with phishing simulations". Anyone running a programme should be able to recite its central claim: "No training package, including phishing simulations, can teach users to spot every phishing attempt. Asking users to examine, in depth, every email they receive will not leave enough hours in the day for work tasks. It’s an unrealistic and counter-productive goal because responding to emails and clicking links is an integral part of work." NCSC’s blog puts it more bluntly still – users "frequently need to click on links from unfamiliar domains to do their job, and being able to spot a phish is not their job".

It’s time for organisations to move away from using blame and fear around clicking links … This means, for example, not running phishing exercises that chastise users for clicking on bad links.– NCSC, 2022

None of that argues for never simulating. It argues against one common design: the exercise that exists to catch people out and tell them off. Everything below builds the other kind.

Blame-free is operational, not polite#

The practical case is stronger than the moral one. NCSC observes that "once a link in a phishing email is clicked and an attack launches, the stigma of clicking can prevent people reporting it, which then delays the incident response", that simulations "erode trust between employees and security", and that "employees who are afraid for their jobs will not report mistakes". A programme that suppresses reporting has made detection worse, whatever the click rate says.

Blaming also fails on its own terms. NCSC: "blaming users for clicking on links doesn’t work. People click for a range of reasons. These could be personality traits or situational (for example, if a person is busy and stressed). Threatening someone with punishment doesn’t change these factors." The target is unreachable anyway: NCSC reviews red team operations and notes that red teamers, criminals and hostile states "only need one person to fall for a ruse" to reach a network. A click can be one step in an attack, but does not automatically establish compromise. Prompt reporting helps the team assess and respond; technical protections remain necessary.

Fix the layers underneath first#

A simulation is layer two of NCSC’s four: make it difficult for attackers to reach your users; help users identify and report; protect the organisation from undetected phishing; respond quickly to incidents. Running an awareness programme while layer one is unbuilt is exactly what NCSC criticises. The technical work comes first:

• DMARC and SPF policies, to reduce delivery of spoofed email. NCSC notes this also helps your own legitimate mail reach inboxes: "the more organisations set up DMARC, the harder it is for the phishers to succeed".
• Email scanning and web proxies, plus DNS filtering, so fewer lures arrive and fewer links resolve.
• Allow-listing so executables cannot run from user-writable directories, locked-down macro settings, disabling .iso mounting on endpoints, and attack-surface-reduction rules.
• EDR and monitoring, with tested detection coverage and an assigned response owner. They do not detect every click or every form of phishing.
• Strong authentication. Prefer phishing-resistant methods such as FIDO/WebAuthn where supported, with secure enrolment and recovery. Password managers help avoid password reuse and filling credentials into the wrong site. Endpoint compromise, stolen sessions and recovery abuse still require separate controls.

Three reasons to train anyway#

NCSC gives them even to organisations with strong technical controls. First, defence in depth: any control can fail. Second, a determined attacker may target your people’s personal accounts, where organisational protections do not apply. Third, users who spot and report suspicious email are "a really useful source of intelligence for organisations, throwing light on compromise attempts that otherwise might be missed". The third reason should shape everything: you are recruiting sensors, not grading exams – which is also what settles the operational design of a campaign.

Lure design: where the line sits#

Realism is not cruelty. A lure exploiting fear about money, employment or family produces a high click rate and buys it with trust you cannot get back. Judge each theme by whether a colleague, told afterwards it was a test, would call it fair.

Lure themes, judged

Lure theme	Verdict	Why
Supplier or invoice notice	Use	Mirrors a common real lure; the loss is organisational, not personal
Internal IT or MFA prompt	Use	Can model credential-harvest attempts without collecting real secrets
Delivery or parcel notification	Use	May be a low-stakes scenario; check relevance and accessibility for the intended audience
QR code in an email	Use with care	ENISA names quishing as a technique that evades endpoint protection and email filtering – realistic, but pair it with coaching, not a scoreboard
Executive request or CEO fraud	Use with care	Realistic, but it tests deference to authority; never report the results by name
Fake pay rise, bonus or expense refund	Do not use	Exploits personal financial hope; reads as a trick played on staff by their employer
Redundancy or disciplinary notice	Do not use	Causes real distress and lasting damage to trust between employees and security
Bereavement or personal emergency	Do not use	No defensible training value that a fairer theme cannot deliver

Transparency about the programme, surprise in the campaign#

The tension is genuine: warn people and you lose realism, surprise them and it can feel like a trap. The workable answer is total transparency about the programme and none about the campaign. Publish in writing, before the first send: that simulated phishing happens; why; that results are aggregated and never used for discipline, appraisal or dismissal; who can see individual-level data and for how long; and exactly how to report a suspicious email. Do not publish timing, themes, sending domains or target groups. This provides programme transparency while keeping agreed campaign details confidential. A programme notice is not employee consent or, by itself, a lawful basis for processing.

Legal, data protection and consultation#

NCSC is direct that "phishing simulations can also create legal risk", because "punishing people for clicking on emails you’ve sent starts to resemble entrapment. For this reason, you should always check with your HR department before undertaking any phishing simulations." A simulation also processes employee personal data. Take these as questions for your DPO and, where one exists, your works council – not conclusions you can reach alone:

• Article 5(1)(a) – is the programme lawful, fair and transparent to the people in it? A published notice is one part of the assessment, not proof of lawfulness.
• Article 5(1)(c) – data minimisation. Do you need identified click data at all, or only who reported plus aggregate counts?
• Article 6(1)(f) – assess whether legitimate interests is an appropriate basis for the specific processing, and Recital 49 recognises processing "to the extent strictly necessary and proportionate for the purposes of ensuring network and information security" as a legitimate interest.
• Article 88 – Member States may set more specific rules for employee data in the employment context, including by collective agreement. This is why the answer differs by country and why works councils matter.
• Article 35(1) – a DPIA is required where processing is likely to result in a high risk. Ask your DPO whether yours qualifies rather than assuming either way.

One group cannot be excluded on grounds of seniority: Article 20(2) of NIS2 requires members of the management bodies of essential and important entities to follow training, and Article 20(1) makes that same body responsible for approving and overseeing risk-management measures, and provides that it can be held liable for infringements. Management training is mandatory for in-scope entities; NIS2 does not prescribe participation in this particular simulation format.

Rules you can hold yourself to#

• No punishment, ever – results never reach performance management, and you say so in writing beforehand.
• No names – leadership sees trends and departments, never individuals or league tables.
• Coach, don’t scold – the landing page names the signals and thanks the person, and does not moralise.
• Fair themes only – nothing exploiting money, employment or family distress.
• Measure reporting – as NCSC puts it, "as well as measuring how many people clicked on a phishing email, focus on how many people reported it".