An unexpected shared document
The decision is whether to follow the notice or open the usual workspace independently. In the debrief, explain the sender, sharing context, and destination checks.
Employee phishing test
Plan a phishing test people can learn from.
Turn an employee phishing test into a clear, manageable exercise: one objective, a defined audience, and a useful next step.
This guide walks through the decisions to make before sending your first simulated email.
Campaign brief · Launch sequence · Employee follow-up
01Campaign brief
Write down the six decisions that shape the test
| Decision | Example for a first exercise |
|---|---|
| Learning objective | Employees open a known workspace independently when a document-sharing notice looks unexpected. |
| Audience | An approved pilot group that has received the relevant reporting guidance. |
| Scenario | A controlled document-sharing notice with an unfamiliar destination and a harmless teaching page. |
| Scope | Approved sender, recipients, delivery window, stop conditions, and escalation contacts. |
| Measurement | Delivery, unique interactions, verified reports where available, and follow-up completion. |
| Follow-up | A debrief explaining the cues, a reminder of the reporting route, and a review of any workflow gaps. |
02Preparation
Agree how the test will work
Name a campaign owner and involve the teams responsible for email delivery, reporting, and employee learning. Confirm how individual results will be accessed and retained. Use your organization's established approval process for the exercise.
Make sure employees can find the real help and reporting channels. A test cannot tell you whether a process works if people have not been told what to do or have no practical way to report from their device.
03Scenario choice
Make the first scenario easy to explain
An account support notice
The decision is whether to trust an unsolicited sign-in request or contact IT through a known channel. Use a harmless teaching page and avoid collecting actual passwords.
04Launch sequence
Run the test in four stages
- 1
Pilot on approved test accounts
Check the message on representative desktop and mobile clients. Exercise each intended action and confirm that the event records and learning page behave as expected.
- 2
Confirm the go-ahead
Check audience membership, timing, support coverage, and stop conditions. Resolve any unexplained pilot events or delivery failures before sending to the wider group.
- 3
Monitor the campaign
Watch delivery and support channels. Give the response team enough context to recognize the exercise without dismissing unrelated reports of real threats.
- 4
Close with a debrief
Explain the scenario and the expected action. Review results privately where appropriate, assign relevant learning, and document changes to the reporting or verification process.
05Review
Read the results without turning them into a label
Start by checking whether the intended audience received the test. Review unique interactions rather than total events, and account for automated scanning. If report tracking is available, examine whether reports reached the right team and received a response.
Use a result to ask a better question: was the policy unclear, was the request expected in this role, or was the reporting tool hard to find? Choose a follow-up action from that explanation. Avoid describing someone as a security risk on the strength of one click.
Common questions
Is a phishing test the same as a phishing simulation?
The terms often describe the same authorized exercise. ‘Test’ can emphasize a particular campaign, while ‘simulation program’ often describes repeated practice and follow-up. Define your scope and learning objective regardless of the label.
How many employees should be in the first test?
Start with a pilot large enough to check your important email clients, devices, and reporting routes. Expand after resolving delivery and measurement issues. The right size depends on your environment and support capacity rather than a fixed number.
Should we collect passwords during a phishing test?
Do not collect real employee secrets. If a simulated sign-in decision is part of the approved exercise, use a design that records the relevant event without retaining the actual password or other sensitive content.
What should happen after an employee clicks?
Provide a clear explanation of the scenario and the expected response. Assign relevant learning when useful, make reporting mistakes easy, and investigate whether unclear processes or tools contributed to the decision.
Sources & further reading
Published by Phishmake · Updated
Keep building your program
All resourcesPut it into practice
Make the next test part of a program.
Use Phishmake to connect employee phishing campaigns with practical training and a record of follow-up activity.