Phishing Simulation Best Practices: How to Run a Program That Changes Behaviour

Hero Summary

A phishing simulation sends employees safe, realistic test messages to see who reports, clicks, or enters data, and uses the results to give feedback and target training. Done well, it builds the habit of pausing and verifying and gives the organization measurable data. Done badly, it becomes a "gotcha" exercise that breeds resentment and hides real risk. The best programs are realistic and varied, cover email, text, and voice, give immediate and respectful feedback, make reporting easy, vary difficulty, and measure behaviour over time rather than chasing a low click rate.

Executive Summary

Phishing and spoofing was the most-reported crime type to the FBI IC3 in 2025, with 191,561 complaints, and phishing was the leading initial attack vector at 18% of breaches in IBM's 2025 India research. Simulation is one of the few ways to practise the response to these attacks safely. This guide covers how to plan a simulation program, design realistic scenarios, handle ethics and communication, give feedback, measure results, and avoid common mistakes.

What a phishing simulation is for {#purpose}

The purpose is not to catch people out. It is to:

• practise recognising and reporting suspicious messages under realistic conditions;
• measure where risk concentrates, by role and group;
• teach at the moment of mistake, when learning is most effective; and
• build a reporting habit that benefits the organization against real attacks.

Plan the program {#plan}

1. Set goals in behaviour terms — for example, increase the reporting rate and shorten time to report — not only reduce clicks.
2. Get leadership sponsorship and include executives; attackers target them.
3. Agree rules with HR and legal on how results are used — typically for coaching and aggregate reporting, not discipline.
4. Take a baseline before training so progress can be measured.
5. Schedule continuous, varied simulations rather than one large annual campaign, and avoid predictable timing.
6. Segment audiences by role and risk, so scenarios fit the attacks each group faces.
7. Coordinate with IT and security teams so filters, allow-lists, and the reporting tool work as intended, and so help desks are not surprised.

Design realistic scenarios {#scenarios}

Use scenarios that mirror current attacks and the situations your people face:

• Common lures: parcel and delivery notices, account security alerts, shared-document requests, HR and payroll notices, IT support messages, invoice and payment requests.
• Role-specific lures: invoice changes for finance, candidate documents for HR, executive impersonation for assistants, credential prompts for IT administrators.
• Varied difficulty: include easy, moderate, and hard examples, including well-crafted spear-phishing that uses plausible internal context. Always record difficulty so trends are comparable.
• Current events and seasonal themes, within ethical limits.
• Multi-step scenarios where a first message builds trust before a second asks for action.

Avoid scenarios that exploit genuine distress, such as fake bereavement, medical emergencies, or threats to employment or pay.

Go beyond email {#channels}

Attackers use text messages and phone calls because they bypass email filters. A complete program also simulates:

• Smishing — text-message lures with links or requests.
• Vishing — phone calls impersonating banks, help desks, vendors, or executives.
• Other channels such as collaboration tools and messaging apps where relevant.

See Smishing and Vishing: How to Defend Against Text and Voice Phishing.

Ethics and communication {#ethics}

• Be transparent that the organization runs simulations as part of its security program, even if individual campaigns are not announced.
• Do not humiliate. Never publish names or use shaming language.
• Protect privacy — limit who can see individual results and how long they are kept.
• Avoid deceptive pretexts that could cause real harm or distress.
• Treat results as coaching signals, not grounds for discipline, except in cases of repeated, deliberate policy violation handled through a defined process.

Feedback and just-in-time learning {#feedback}

When someone clicks, the next ten seconds are the most valuable teaching moment. Provide an immediate, friendly explanation that shows what gave the message away and what to do next time, followed by a short, relevant lesson. For people who fail repeatedly, offer additional support rather than escalation.

Make reporting the goal {#reporting}

Provide a single, easy way to report — a button in the mail client or one address — and acknowledge every report, including false alarms. Celebrate good reporting, and track the reporting rate and time to report. A reported simulation is a success even if the person also clicked, because the security team would have been alerted to a real attack.

Measure properly {#measure}

• Reporting rate and time to report.
• Failure rate by role, channel, and difficulty.
• Data-entry or action rate among those who clicked.
• Repeat-failure rate.
• Trends over quarters, keeping methodology consistent.

Do not treat a falling click rate as proof of success if simulations became easier. See How to Measure Human Cyber Risk.

Common mistakes {#mistakes}

• Running one big campaign a year.
• Using the same template for everyone, so people warn each other.
• Only email, ignoring text and voice.
• Shaming or punishing people who click.
• Overly easy simulations that flatter the numbers.
• No follow-up learning after a failure.
• No easy reporting route.
• Ignoring real attacks. Simulations complement, but do not replace, filtering, authentication, and incident response.

How Threat ResQ's TRAP fits {#trap}

TRAP is the phishing simulation capability within TRISA, Threat ResQ's AI security awareness and human risk intelligence platform. It combines interactive training with continuous phishing, smishing, and vishing simulation, with more than 1,000 phishing templates across 130+ languages, SIEM integration, and cloud or on-premises deployment. Simulation results feed TRISA's continuous readiness scoring and its department-level and board-level reporting. Threat ResQ's Security Awareness Services provide a facilitated, human-led layer alongside the platform.

FAQ {#faq}

What is a phishing simulation? A safe, realistic test message — usually email, but also text or voice — sent to employees to measure how they respond and to give immediate feedback and training.

How often should we run phishing simulations? Continuously, with varied scenarios and unpredictable timing, rather than one large annual campaign. The right cadence depends on your size and risk.

Should employees be punished for failing a simulation? Generally no. Treat results as coaching signals and aggregate data. Punishment discourages reporting, which is the behaviour you most want.

What is a good phishing simulation click rate? There is no universal target, because the rate depends on simulation difficulty. Track the trend using consistent methodology and focus on reporting rate and time to report.

Do phishing simulations need to include text and phone calls? They should where relevant. Smishing and vishing bypass email filters and are used by attackers, so a complete program practises those channels too.