Phishing Simulations Done Right: Coaching, Not Punishment

Phishing remains one of the most common ways attackers get into organisations. A convincing email persuades someone to click a link, open an attachment, enter a password or approve a payment, and the attacker is in. Technical controls block a great deal, but some messages always get through. At that point, people are the last line of defence.

Phishing simulations, sending realistic but harmless test emails to staff, are a common way to build that defence. Done well, they help people recognise and report suspicious messages. Done badly, they create resentment, encourage people to hide mistakes and give security teams a false sense of progress. This article covers how to get them right.

What simulations are for

The goal of a phishing simulation programme is not to catch people out. It is to:

• Build recognition, so people spot the signs of a malicious message.
• Build reporting habits, so suspicious messages reach the security team quickly.
• Provide learning at the moment it matters, immediately after a mistake.
• Give the organisation a realistic picture of where human risk is concentrated.

Keep those aims in mind and many design decisions become straightforward.

Design simulations people learn from

Make them realistic, but fair

Simulations should reflect the kinds of messages attackers actually send: delivery notifications, shared document alerts, invoice queries, password expiry warnings, messages that appear to come from senior leaders. A simulation that is wildly unrealistic teaches nothing.

At the same time, avoid scenarios that exploit genuine distress or break trust, such as fake announcements about bonuses, pay cuts, redundancies or health emergencies. They may produce high click rates, but they damage relationships far more than they build skills.

Vary difficulty over time

Start with messages that have clear warning signs, then gradually make them harder. Tailor some simulations to roles with particular risks, such as finance teams who handle payments or executives who are targeted by impersonation.

Go beyond email

Attackers also use text messages, phone calls and messaging platforms. Where appropriate and lawful, include other channels, focusing on high-risk roles such as reception, help desks and finance.

What happens after someone clicks

This is where most programmes succeed or fail.

Coach, do not punish

When someone clicks a simulated phish, show them immediately, in a short and friendly message, what happened and which signs they could have spotted. Most people learn more from that moment than from any annual course.

Avoid naming and shaming, disciplinary threats or forcing people through long, generic training as a penalty. These approaches teach people to fear the security team and, crucially, to hide real mistakes.

Support repeat clickers

Some people click more often than others, sometimes because their role exposes them to more messages, sometimes because they need more support. Offer them short, personal coaching rather than escalating sanctions.

Measure reporting, not just clicking

Click rate is the measure most programmes track, and it is useful. But the more important measure is reporting: how many people report a suspicious message, and how quickly.

In a real attack, it does not matter much if a few people click, provided someone reports the message early enough for the security team to respond. A high reporting rate and short time to report are signs of a genuinely resilient workforce.

Make reporting easy, for example with a single button in the email client, and tell reporters what happened. Recognise good reporting publicly. People who report a real phish that turns out to be part of an attack deserve thanks, not silence.

Encourage people to admit mistakes

The most dangerous phishing outcome is someone who clicked a real malicious link, realised something was wrong, and said nothing because they were afraid of the consequences.

A healthy security culture makes it safe, and expected, to report your own mistakes quickly. Simulations should reinforce that message: "If you click something you shouldn't have, tell us straight away. The sooner we know, the less harm it does."

Common mistakes

• Using click rate as a performance target. It encourages easy simulations that make the numbers look good.
• Running simulations without supporting training. Simulations reveal gaps; they do not fill them on their own.
• Ignoring the reporting process. If reports go to an unmonitored mailbox, people stop reporting.
• Failing to tell people about the programme. Staff should know that simulations happen and why. Telling people in general terms does not undermine the programme; surprising them with no context damages trust.
• Treating people as the problem. Technical controls, such as email filtering, link protection and multi-factor authentication, should reduce how many malicious messages people need to judge in the first place.

Phishing is one part of human risk

Phishing resilience is one piece of a wider picture of how people affect security: awareness and training, insider risk, security culture, decision-making under pressure and how human risk is measured. Organisations that do well treat people as part of the defence rather than the weakest link.

The Human Behaviour Security assessment covers all of these areas, including phishing and social engineering resilience. It is a useful way to check whether your simulations sit within a broader, supportive programme, or are standing in for one.

Frequently asked questions

How often should we run phishing simulations?

Many organisations run them monthly or quarterly. Regular, varied simulations with immediate coaching tend to work better than occasional large campaigns.

Should we tell staff we run phishing simulations?

Yes. Tell people that simulations are part of the security programme and explain why. You do not need to announce individual campaigns.

What is a good phishing click rate?

There is no universal benchmark, because results depend heavily on how difficult the simulations are. Track your own trends over time, and give at least as much attention to reporting rates and time to report.