Phishing simulations that don't punish people

The purpose of a simulation

A phishing simulation sends realistic but harmless test emails to staff to see how they respond. Done well, it gives people safe practice recognizing threats and gives the business useful data about where more training is needed. Done badly, it becomes a game of catching people out, which damages trust and makes staff less likely to report real problems.

The goal is not a perfect click rate. Some people will always click on a convincing message, because attackers design them to work. The real goal is to build habits of pausing, checking and reporting, so that when a real attack slips through, someone notices and raises the alarm quickly.

Measure reporting, not just clicking

Many programs only track how many people clicked. A more useful measure is how many people reported the message, and how quickly. A high reporting rate means your team is acting as an early warning system, which is valuable even if a few people still click. It also shows that your staff understand how to report and trust that reporting is welcome.

Make sure reporting a simulated phish is rewarded in the same way as reporting a real one, with a quick thank you or a short confirmation message. Track the time from the first email arriving to the first report. In a strong program, that time gets shorter month by month, which shows the team is genuinely getting better.

• Report rate
• Time to first report
• Click rate, as a secondary measure
• Repeat clicks over time

Design fair, realistic tests

Base simulations on the kinds of messages your staff actually receive: shared document notices, delivery alerts, invoice reminders and Microsoft 365 sign-in prompts. Vary the difficulty, starting with easier messages and building up over time. Avoid themes that cause real distress, such as fake layoffs, bonuses, health scares or personal tragedies, which damage trust far more than they teach.

Tell staff that simulations will happen, without saying when. Being open about the program reduces resentment and makes people more alert in general. Run tests regularly, such as monthly or every other month, so practice is ongoing rather than a single event. Explain how results will be used, and stress that the program exists to help people rather than to rank them.

Teach in the moment

When someone clicks a simulated phish, the best response is a short, friendly explanation that appears right away. Show the clues they could have noticed, such as the sender address, the link destination or the urgent tone, and offer a two-minute learning module. People learn best when the experience is fresh.

Avoid naming people publicly, sharing individual results with colleagues or tying simulation results to performance reviews or discipline. If someone repeatedly struggles, offer one-on-one coaching in a supportive way. Some people need more help than others, and a respectful approach gets better results than pressure. Punishment teaches people to hide mistakes.

Use results to improve the system

Look at simulation results as information about your organization, not just about individuals. If many people fall for a fake shared document, perhaps your real file sharing practices are confusing. If a department never reports anything, perhaps they do not know how. Fix the system as well as training the people.

Share overall results with the team in a positive way, focusing on improvements and good catches. Combine simulations with strong technical controls, such as email filtering and multi-factor authentication, so that a single click is less likely to lead to real harm. Training and technology work best together, and neither is enough on its own.