Phishing simulation for business: how it works and what to measure

A phishing simulation for business is a controlled exercise in which employees receive a safe message resembling a real attack. Its purpose is not to catch people out or rank the “weakest employees”. A well-designed simulation checks whether the organisation can identify a suspicious request, verify it through another channel, report it quickly and begin a response.

The click rate alone does not answer those questions. A campaign with obvious spelling mistakes and an unrelated domain may produce a low number but will not prepare the team for a hijacked invoice thread, a convincing Microsoft 365 page or a follow-up phone call. An extremely difficult scenario without constructive feedback can simply damage trust.

The best phishing simulation combines a realistic but safe scenario with privacy safeguards, clear employee support and a process-improvement plan. It measures reporting and decisions, not just clicks.

How does a phishing simulation work?

1. Define the objective

The organisation first decides what it wants to test. This may be a fake sign-in page, supplier bank-detail change, QR code, unusual shared document or reporting a message from a compromised account. The objective should reflect real organisational risk.

2. Select the audience and scenario

The scenario must match the audience. Finance employees make different decisions from HR, help desk, developers or leadership. A message may reflect a normal process, but should not disclose genuine sensitive information, exploit personal tragedy or cross agreed boundaries.

3. Agree safeguards

Before launch, define which data will be collected, who can see results, how long records are retained and how employees receive support. A safe landing page does not need a real password, MFA token or payment-card details. It can record an agreed action and immediately explain the exercise.

4. Send the campaign under control

The campaign needs an owner, approved window and emergency contact. IT, the help desk or SOC must be able to distinguish the exercise from a real attack without disclosing the scenario to participants in advance.

5. Provide feedback

Someone who clicks should receive a short explanation of the signals and correct response. A person who reports the message also needs acknowledgement. Ignoring good reports quickly teaches employees that reporting has no value.

6. Analyse and improve

The report should explain results in the context of scenario difficulty, assess the reporting process, and identify technical and organisational gaps. The campaign ends with actions: improve the reporting button, payment process, email controls or MFA, or provide targeted practice to a particular group.

Phishing simulation examples for employees

A useful scenario library extends beyond a parcel-delivery link. Depending on risk, an organisation may test:

• a fake Microsoft 365 or Google Workspace document invitation;
• an expiring session or unexpected MFA message;
• a supplier bank-detail change;
• a QR code leading to a sign-in page;
• an IT-support installation or screen-sharing request;
• a recruitment attachment sent to HR;
• an alert from a tool used by a technical team;
• an urgent data or payment request signed by an executive.

The scenario should not teach people merely to spot spelling errors. Modern phishing can use polished language and authentic context. Exercises should focus on the requested action and independent verification. Our guide to phishing in 2026 explains the additional defensive layers.

Which phishing simulation metrics matter?

Reporting rate

This shows how many recipients informed the correct team. It is more useful than non-clicking alone because a report creates an opportunity to protect other people.

Time to first report

The faster a signal arrives, the more time the organisation has to block a domain, revoke sessions and warn colleagues. Measure the median and distribution, not only the best result.

Report quality

Did the employee use the correct channel? Was the email reported through a button or forwarded as an attachment so headers were preserved? Did the response avoid replying to the attacker?

Risky actions

Depending on the objective, a campaign may record opening, clicking, attempting to submit data or starting a payment process. It does not need to retain entered content; an event showing that the form was submitted is usually sufficient.

Reporting one’s own mistake

This is one of the strongest security-culture signals. A person who reports quickly after clicking can help contain an incident. Shame and punishment increase the chance that events remain hidden.

Corrective-action closure

A campaign is valuable when it causes change. Track recommendations with an owner, date and confirmed completion.

Why click rate can be misleading

NIST created the Phish Scale to rate human phishing detection difficulty. It considers message characteristics and the recipient’s context. NIST research shows that a premise aligned with normal work can be harder to detect, so click-rate changes do not automatically prove that employees improved or deteriorated.

The practical lesson is simple: do not compare a “password reset” campaign with an “invoice change” campaign without assessing difficulty. Do not directly compare two departments when one received a generic email and the other a scenario closely aligned with its everyday work.

Note that the NIST project page describes licence terms for use of the Phish Scale, including separate requirements for commercial applications. Organisations and service providers should check the current terms before incorporating the method into a paid service.

Employee privacy in a safe phishing simulation

The organisation should agree the processing basis and data scope with its privacy, HR or legal advisers. This article is not legal advice. Whatever formal model applies, use these safeguards:

• collect only data necessary for the exercise objective;
• never retain entered passwords, codes or personal details;
• restrict access to results;
• define retention before launch;
• report group and process outcomes to leadership;
• give employees clear feedback and a questions channel;
• do not use the campaign for public shaming.

CISA awareness material recommends rewarding positive behaviour rather than punishing mistakes, and providing the correct answer and an explanation of the tricks used after a simulation. That supports a culture in which real mistakes are reported quickly.

How often should a business run phishing simulations?

Frequency should follow the objective, risk and ability to implement lessons. Quarterly campaigns or several smaller exercises per year may suit many organisations, but this is not a universal rule. Finance may need a quick retest after a payment-process change, while a stable employee group may benefit from a different scenario after several months.

Do not launch another campaign merely because the calendar says so. Close actions from the previous one first. Repeated testing without feedback creates fatigue and distrust.

How to choose a phishing simulation provider

Ask the provider:

1. How is the scenario designed and approved?
2. Which data is collected and where is it stored?
3. Does the landing page retain passwords or tokens?
4. How is message difficulty assessed?
5. Does reporting cover employee reports and response time?
6. How will the provider support the help desk and SOC?
7. What will someone see after clicking or reporting?
8. Which recommendations will the organisation receive?
9. Does the programme include retesting and corrective actions?

Breachroad combines a controlled scenario with short training, behavioural metrics and a post-campaign workshop. Explore our phishing simulations and cybersecurity training for organisations.

Source facts and Breachroad recommendations

NIST TN 2276 describes the Phish Scale as a method for adding message-difficulty context to simulated-phishing results. CISA recommends positive reinforcement, avoiding punishment for mistakes and explaining the scenario after the exercise. The six-stage model, metric set, privacy safeguards and provider questions are Breachroad recommendations.

If someone clicked a real message, do not wait for a campaign report — follow the first-hour phishing response plan.

Business phishing simulation FAQ

Should employees know that simulations take place?

The organisation should agree programme rules and communicate its existence according to its own requirements. The exact date and scenario normally remain confidential so the exercise measures a natural response.

Can a simulation collect employee passwords?

A safe programme does not need real passwords or tokens. Recording an agreed event, such as form submission, is enough without retaining the content.

What is a good phishing click rate?

There is no universal threshold. Results depend on message difficulty and context. Assess trends across comparable scenarios alongside reporting rate and response time.

Does a phishing simulation replace training?

No. A simulation reveals behaviour and process gaps. Training explains decisions, while technical controls limit the impact of mistakes. An effective programme combines all three.

Primary sources: NIST TN 2276 — Phish Scale User Guide, NIST — Human-Centered Cybersecurity: Phishing, CISA — Cybersecurity Awareness Month Toolkit.