Finance: a payment change
Practice checking a supplier request through an established contact. The debrief should explain the verification procedure and who can authorize a change, not just which email detail looked unusual.
Simulation playbook
Phishing simulation best practices.
A useful simulation tells you what to improve: a reporting habit, a verification step, or the training that comes next.
Use this playbook to plan, pilot, and review an exercise your team can learn from.
For security teams, IT administrators, and awareness program owners
01Plan
Choose one behavior to practice
Write the objective as something an employee can do. For example: verify a change to supplier bank details using the established contact record. This gives you a better scenario and debrief than a goal such as ‘reduce human risk.’
Agree on the audience, exercise owner, timing, escalation route, and information you will retain. Coordinate with the teams that will receive reports. Employees should understand the organization's testing policy and how results are used, even when individual campaign details are not announced.
02Before launch
A practical phishing simulation checklist
| Check | Ready when | Suggested owner |
|---|---|---|
| Scope and approval | Audience, dates, learning objective, stop conditions, and data handling are recorded. | Program owner |
| Scenario review | The message fits the audience and avoids distressing personal pretexts or real sensitive data. | Awareness lead |
| Delivery pilot | Test recipients receive the intended message and the landing page works across supported devices. | Email administrator |
| Event checks | Expected test actions appear correctly; scanner activity and duplicate events are understood. | Campaign administrator |
| Reporting route | The designated mailbox or reporting tool reaches a monitored team with clear handoff instructions. | Security operations |
| Debrief and support | Explanations, help contacts, and relevant learning are ready before launch. | Training owner |
03Scenario design
Match the scenario to the work
Distributed teams: a document share
Use an unexpected collaboration notice to practice opening the approved workspace independently. Include the actual reporting route for employees working outside the main office.
New starters: an account notice
Reinforce how employees find their real IT help channel. Avoid placing an unfamiliar employee in a test before they have received the relevant guidance.
Managers: an urgent exception
Practice pausing when a request tries to bypass approval. Keep the exercise focused on the decision and avoid threats about employment, pay, or personal circumstances.
04Pilot first
Use a small pilot to find workflow problems
- 1
Test the whole path
Send to approved test accounts on representative email clients. Check message rendering, links, landing pages, and the learning experience on desktop and mobile.
- 2
Reconcile the events
Compare deliberate pilot actions with recorded events. An email security scanner may visit links before a person does. Identify limitations before interpreting the results.
- 3
Exercise reporting
Have a test participant use the normal reporting route. Confirm receipt, triage ownership, and how the team distinguishes an exercise from a live incident.
- 4
Make the launch decision
Resolve missing tracking, broken links, delivery problems, and unanswered reports. If an exercise creates operational disruption, stop it and investigate before expanding the audience.
05Interpretation
Compare exercises in context
Compare unique recipients and consistent denominators. Record the scenario, audience, delivery window, and exclusions beside the metrics so the next campaign can be interpreted fairly.
NIST's Phish Scale provides a way to assess the human detection difficulty of phishing messages. Use difficulty as context when interpreting simulation results; a lower click rate on an easier message is not enough to demonstrate improvement.
Source: NIST Phish Scale User Guide
06Follow through
Turn the review into a change
Show the message cues and the action the employee should take next time. Acknowledge people who report concerns. Provide relevant reinforcement without public ranking or blame.
Record one or more improvements with an owner and review date: simplify the reporting route, clarify a payment policy, improve an email control, or reinforce a specific topic. Choose the next scenario based on the remaining gap rather than repeating a familiar message to obtain a better score.
Common questions
How often should phishing simulations run?
Choose a cadence based on the audience, risks, program maturity, and capacity to act on results. Leave enough time for relevant learning and operational follow-up. Increase or change practice when roles, systems, or threats change; there is no single schedule that fits every organization.
Should phishing tests be a surprise?
Employees can know that a simulation program exists without knowing each message or launch date. Explain the program's purpose, reporting process, and data handling, then follow your approved internal policy for individual exercises.
Should employees who click be punished?
Use a simulation as an opportunity to understand a decision and improve the process. Provide private, relevant follow-up and look for unclear workflows or controls. Public blame can discourage people from reporting mistakes promptly.
Should we bypass email protection for a simulation?
An awareness exercise and a test of email defenses have different goals. Agree the scope with your email administrator. Any delivery exceptions should be narrow, documented, tested, and reviewed; do not treat a bypassed control as evidence that real attacks would reach employees.
Sources & further reading
Published by Phishmake · Updated
Keep building your program
All resourcesPut it into practice
Build a repeatable simulation workflow.
Explore how Phishmake connects phishing campaigns, employee activity, follow-up training, and reporting.