How to run a phishing simulation: a step-by-step programme

Decide what the programme is for#

A simulation is not a test of whether your colleagues are clever. It rehearses one behaviour – noticing something odd and saying so quickly. The UK’s NCSC warns that "phishing mitigations often place too much emphasis on users being able to spot phishing emails" and that this "risks wasting both time and money without improving security". The criticism is fair, and the answer is to put the programme where NCSC itself puts it – layer two of four. Layer one makes it difficult for attackers to reach your users; layer two helps users identify and report suspected messages; layer three limits the effects of the phish that lands anyway; layer four is fast incident response. A simulation sold as the whole defence deserves the scepticism. One that measures reporting and sits on working technical controls does not.

Get HR in the room before the first send#

NCSC is explicit that simulations "can also create legal risk": since no one can be expected to spot all phishing emails, "punishing people for clicking on emails you’ve sent starts to resemble entrapment. For this reason, you should always check with your HR department before undertaking any phishing simulations." Treat that as a prerequisite, not a formality. Before the baseline, write down on one page what you measure, who sees individual-level data, how long you keep it, and the commitment that results never feed performance management or discipline. Have HR, your data protection officer and, where one exists, the works council sign it. The ethics and consultation questions are worth settling in full before you design a single lure.

The campaign timeline#

A campaign is seven stages; most programmes stop after the third. Record something at every stage: data you fail to capture during the send window cannot be reconstructed afterwards.

One campaign, stage by stage

Stage	What you do	What you record
Baseline	An agreed campaign with documented difficulty, audience, exclusions and prior training	Click, submission and report rates by department; time to first report
Design	Pick one scenario that mirrors a lure your sector actually sees; agree the landing-page wording with HR	Theme, difficulty, sending domain, exclusions and the reason for each
Send window	Agree a delivery window and record it; account for legitimate peer warnings when interpreting results	Delivery timestamps, bounces, who was genuinely reachable
Teachable moment	Show a short coaching page the instant someone clicks	Whether the page was reached, and from which scenario
Follow-up training	Assign a short module within days, not months	Completion and date, so recency can be analysed later
Report	Aggregate trends for leadership; never individual names	Rates, resilience ratio, coverage, movement since the last campaign
Re-baseline	Repeat with documented difficulty; compare like-for-like campaigns or explain changes	The same fields, including difficulty and audience, to assess comparability

Design lures for the threat that actually exists#

ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025. Phishing – including vishing, malspam and malvertising – was the intrusion vector in roughly 60% of observed cases, the single largest, ahead of exploitation of vulnerabilities at 21.3%, botnets at 9.9% and malicious applications at 8%. The more useful finding is what phishing is used for: only 23% of phishing cases led to the deployment of malicious code, which ENISA reads as a sign that phishing "might be primarily used for malware-less objectives". By comparison, nearly 70% of vulnerability cases culminate in intrusions and 68% deploy malicious code.

Choose scenarios from the threats and workflows relevant to your organisation. A mock login prompt can test whether someone attempts a submission, but it must not collect real passwords, one-time codes, session tokens or sensitive documents. Attachment scenarios must use benign files and agreed technical safeguards. ENISA reports many phishing outcomes as unknown, so the data does not support reducing the whole programme to a single lure type.

Choose difficulty to answer the learning objective, and record changes so results remain interpretable. ENISA describes phishing-as-a-service and QR-code phishing as relevant developments; QR codes can make some email and endpoint checks less effective. These observations support reviewing scenarios, not automatically increasing difficulty every round. A harder lure can raise clicks even when people have learned useful skills.

Who to include#

Define the audience from roles, exposure, accessibility needs and legal requirements; include leadership and technical teams where relevant, with documented exclusions. Article 20(2) of NIS2 requires management-body training for in-scope entities, while Article 21(2)(g) separately includes cybersecurity training among risk-management measures. Neither provision mandates a phishing simulation or a particular campaign audience. Management oversight and the possibility of liability under Article 20(1) remain separate obligations.

Make reporting one click#

A difficult reporting process can suppress useful reports. NCSC’s advice is to "make it easy for users to report suspicious emails, such as using email add-ins widely". Before the baseline, confirm three things: a report control exists in the client every employee actually uses, including mobile; reports land in a queue a human monitors, with a defined response time; and whoever reports gets an acknowledgement. If reporting means composing a fresh email to a shared mailbox with the original attached as an .eml file, your report rate measures persistence, not vigilance.

What happens after a click#

Two things, in that order. First the teachable moment: a short page naming the two or three specific signals in this email, thanking the person for their time, and explaining what campaign data is recorded and confirming it is not used for punishment. Keep it to one screen – a page that scolds converts one click into one fewer future report.

Second, review the technical controls relevant to the scenario. Spotting alone cannot protect every account, and some phishing seeks credentials while other attacks seek payments, information or malware execution. CISA ranks MFA strongest to weakest: FIDO/WebAuthn and PKI-based authenticators are phishing-resistant; app-based one-time passwords and push notifications are better than nothing but are not phishing-resistant; SMS and voice one-time passcodes are the weakest. The named attacks explain why – a proxy login page harvests the username, password and the six-digit code together; push bombing wears people down until they approve; SS7 protocol exploitation intercepts SMS and voice codes; a SIM swap takes the number outright. CISA’s summary is worth repeating to whoever owns the identity roadmap: "While any form of MFA is better than no MFA and will reduce an organization’s attack surface, phishing-resistant MFA is the gold standard."

The mistakes that ruin a programme#

• Optimising only for click rate without reporting and response context. See what to measure and why.
• Sending the same easy lure every quarter, then reporting the flattering trend.
• Presenting a baseline as untrained when participants have already received relevant training.
• Excluding the executive team, the security team, or contractors with mailboxes.
• Publishing departmental league tables, which teach people to warn each other instead of reporting.
• Leaving the reporting queue unattended during the campaign, which teaches people that reporting achieves nothing.
• Ignoring timely reinforcement after an exercise. Assess whether concise follow-up helps your audience and reporting process.

Run it again, and keep the series comparable#

The most useful discipline here is boring: change one variable at a time and keep the recorded fields identical from campaign to campaign. A programme that varies theme, difficulty, audience and tooling at once produces numbers no board or auditor can compare. Set a cadence you can sustain: the Verizon DBIR associates the reporting benefit with training received within the previous 30 days, which argues for something continuous rather than an annual event. Review safety and operational problems immediately, and interpret trends only when enough comparable campaigns are available.