Organisations should start by defining the behaviours they want to change, then run small, relevant simulations for different user groups. Use a mix of lures, track who clicks, enters credentials or reports the message, and follow up with targeted training. Keep scenarios realistic, measure trends over time and avoid using simulations to shame users.
Start with the behaviour you want to change, not the email template
Phishing simulation works best when it is tied to a clear behavioural goal. Start by deciding whether you want people to report faster, avoid credential entry, recognise risky links, or escalate suspicious messages more reliably. That choice shapes the audience, difficulty, timing and follow-up, so the programme measures real improvement instead of just sending more test emails.
Small, relevant pilots are usually better than a broad rollout. Different roles face different lures, so finance, executives, support teams and general staff should not all receive the same scenarios. A good first pass is to test a few realistic messages, then compare click, submit and report behaviour so you can see which groups need coaching and which controls already work.
Phishing also sits inside a wider exposure path, because a single click can lead to credential capture, session theft or access to internal tools. Guidance on common phishing patterns and lure types is useful when shaping scenarios, and a Phishing Guide helps teams choose realistic lures rather than obvious decoys.
Design simulations so they teach without training people to ignore warnings
Realism matters, but the point is not to trick users for its own sake. A simulation should resemble the messages people actually see in the organisation, whether that means payroll notices, document sharing prompts, meeting invites or support tickets. If the scenario is too synthetic, users learn nothing useful; if it is too aggressive, they may become defensive or start treating every test as punishment.
Good programmes also separate measurement from blame. Track who clicked, who entered credentials, who reported the message and how quickly they reported it, then use that data to adjust coaching and content. Over time, the useful metric is not a single campaign score but the trend in reporting behaviour and the reduction in risky actions across similar groups.
For teams building a repeatable programme, the most useful operational guidance is in a Phishing Simulation Programme Guide, which covers ethics, difficulty selection, reporting metrics and allowlisting concerns that often affect early deployments.
Use the results to target follow-up training and reporting habits
The value of simulation comes from what happens after the test. Users who click but do not enter credentials need one kind of intervention, while users who submit credentials need a different one, because the latter indicates a stronger gap in judgement or process. People who report the message quickly are just as important to study, since they show where awareness and reporting mechanisms are working.
A practical first programme should therefore include a feedback loop. After each campaign, review patterns by business unit or role, send short targeted coaching where needed, and make sure the report-phishing path is simple enough to use under time pressure. If the organisation already has a reporting button or security mailbox, the simulation should measure whether people actually use it rather than assuming they will.
If the goal is to build a broader human-risk programme rather than a one-off campaign, the Security Awareness and Human Risk Management Guide is useful for connecting phishing simulation to behaviour change, metrics and culture without reducing it to a single click rate.
Risk and Threat Considerations
Phishing simulations expose more than awareness gaps. If they are poorly designed, they can create distrust, trigger complaints or teach users to ignore tests and real warnings alike. They also reveal which user groups are most likely to interact with malicious messages, which means the programme itself needs careful control over delivery, timing and internal visibility.
Failure mechanism: Users may learn the pattern of the simulation, the organisation may over-rely on click rates, or overly punitive follow-up may reduce reporting and increase concealment. A poorly scoped campaign can also miss the roles that matter most, leaving the highest-risk groups under-tested.
Impact: The organisation may get a false sense of security, weaken trust in the security team, and leave a real social-engineering path open. In the worst case, a simulated lure can normalise bad habits if it rewards guessing the test instead of reinforcing safe behaviour and prompt reporting.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Phishing simulation is a security awareness control focused on behaviour change. |
| Recommendation — Run targeted awareness exercises and measure whether users report suspicious messages faster. | ||
| NIST CSF 2.0 | PR.AT-01 — Awareness and Training | The topic is about building user awareness through repeated phishing exercises. |
| DE.CM-09 — Personnel Activity Monitoring | Simulation metrics track user responses and reporting behaviour over time. | |
| Recommendation — Use awareness training to reinforce phishing reporting and safe-response behaviours. Measure response patterns to identify where phishing risk remains highest. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Security Awareness Training | Phishing simulation supports awareness training by testing user response to social engineering. |
| Recommendation — Include phishing simulations as part of role-appropriate security awareness training. | ||
| ISO/IEC 27001:2022 | A.6.3 — Information security awareness, education and training | Phishing simulation is a practical awareness and education activity under ISMS controls. |
| Recommendation — Use simulations to verify that awareness training changes user behaviour in practice. | ||
Practitioner Guidance
What to prioritise: Start with one or two behaviours that are easy to observe and improve, then design the campaign around those outcomes. For most organisations, reporting speed and unsafe credential submission are better first indicators than a broad awareness score.
What to verify: Confirm that the simulation has a clear escalation path for users who report it, that follow-up training is short and specific, and that the campaign can be segmented by role or department without exposing personal performance data more widely than necessary.
Practitioner takeaway: The best first programme is small, credible and measurable, with a feedback loop that improves reporting behaviour rather than simply catching people out.