Running phishing simulations without scaring your people

Phishing simulations work, but not the way many organisations use them. Use them to show who got it wrong and you get staff who cover themselves. That is exactly the behaviour you do not want in a real attack.

Measure the right number

The click rate is the figure everyone looks at and the least interesting one. Far more relevant: how many people report the mail, and how fast. In a real attack that reporting speed decides whether you block one account or fifty.

So we always report three numbers: clicks, entering credentials and reporting. That third number is the one you want to see rise.

Say in advance that you test

That sounds contradictory, but it works. Announce that simulations happen periodically, without saying when. Then it is an exercise rather than a trap, and the atmosphere stays intact.

What not to do: send a one-off simulation on a sensitive subject, for example about salary or redundancy. The click figures are spectacular, and the trust is gone.

Report at department level

Technically you can see who did what. The question is whether you want to use it. We advise reporting per department and per period: you see where extra attention is needed without holding anyone to account.

With an employee who falls for it repeatedly, a conversation makes sense. Not as a sanction, but because that person often behaves riskily in other systems too.

Make the simulation realistic

The most instructive simulations resemble mail the organisation really receives: an invoice from a known supplier, a request to change bank details, an invitation to a shared document. Generic prize-draw emails teach nobody anything, because everyone spots them.

Ask internally for examples of real attempts. Those make the best basis.

Tie it to the technology

Training without technology is half a measure. Mail and phishing filtering, multi-factor authentication, conditional access and monitoring of DKIM, DMARC and SPF belong with it, as does a password manager so passwords are not reused.

That reduces both the chance a message arrives and the damage when someone clicks anyway.