Gophish is an open-source phishing simulation framework used to run awareness tests and measure user response to fake campaigns. Security teams use it to send controlled emails, track clicks and collect training data. It must be tightly controlled so simulations are authorised, scoped and do not expose real credentials or broader mail access.
What Gophish Is Used For
Gophish is most useful when an organisation wants to test phishing awareness under controlled conditions rather than guess at it. The framework helps security teams measure how people respond to simulated lures, how often they report them, and where awareness gaps remain.
That makes the tool operationally valuable, but it also means the simulation itself becomes part of the security program. The campaign design, sender infrastructure, landing pages, tracking, and any training data collected all need clear scope and ownership so the exercise stays a test and not a source of exposure.
How Phishing Simulation Campaigns Work
A phishing simulation framework typically starts with a campaign plan, then delivers crafted messages to a defined audience, tracks interaction, and records outcomes for analysis. In practice, the point is not just to see who clicks, but to understand what kind of lure works, which teams need coaching, and whether the reporting path is easy to use.
Good programs treat simulations as controlled measurement, not one-off stunts. That usually means defining the audience, the campaign frequency, the allowed themes, the data that will be collected, and the people who are allowed to run or approve a simulation. NHIMG’s Phishing Simulation Programme Guide covers the programme design choices that keep testing ethical and repeatable.
Because phishing simulations rely on realistic delivery, they often intersect with mail security controls, allowlisting, and internal reporting workflows. A useful programme preserves realism while avoiding collateral impact on legitimate mail systems, help desks, or security monitoring.
Why Controlled Simulation Matters
Phishing simulations are only credible when they are tightly governed. If the campaign is too broad, too frequent, or poorly coordinated, it can confuse users, undermine trust in security communications, or create noise that weakens detection and response operations. If the content is too benign, it will not measure real behaviour. If it is too aggressive, it can cross into disruption or deception that is hard to justify.
That balance is why many organisations pair simulation work with human risk management and awareness metrics. NHIMG’s Security Awareness and Human Risk Management Guide explains how phishing exercises fit into broader behaviour change, coaching, and measurement programmes.
Simulation also has an identity and data boundary. If a platform captures credentials, session tokens, or mailbox artefacts, those materials must be handled as sensitive security data, even if the original intent was training. That is why the strongest programmes use minimal collection, strong approvals, and strict retention limits.
What To Watch In Phishing Testing Programs
The most common failure mode is not the simulation email itself, but weak control around who can launch campaigns, what they can target, and what data the platform can capture. A poorly scoped test can accidentally reach the wrong recipients, expose real credentials, or create an operational incident that looks like a live attack.
Phishing simulation also becomes risky when teams over-optimise for click metrics and under-optimise for learning value. A better programme measures report rate, response quality, and whether users correctly escalate suspicious messages. NHIMG’s Security Awareness Training Buyer’s Guide is useful when you need to compare platforms that support reporting, scoring, and simulated campaign management.
On the threat side, simulated phishing can overlap with real attacker tradecraft if campaign infrastructure, templates, or tooling are not isolated. That makes delivery hygiene, approval workflows, and post-campaign review part of the security model rather than administrative details.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Phishing simulation is a practical awareness-control activity within security training and behavior change. |
| Recommendation — Use CIS-14 to run measured phishing simulations that reinforce user reporting and awareness outcomes. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Awareness Training | Simulated phishing is a common mechanism for awareness training and user response measurement. |
| AU-2 — Event Logging | Simulation platforms collect interaction data that must be logged for analysis and oversight. | |
| AC-6 — Least Privilege | Campaign tools should be tightly scoped so operators only have the access needed to run approved exercises. | |
| Recommendation — Include phishing simulations in AT-2 training to validate recognition and reporting behaviors. Log simulation events and outcomes under AU-2 so campaign results are reviewable and auditable. Apply AC-6 to limit who can create, launch, and inspect phishing campaigns. | ||
| ISO/IEC 27001:2022 | A.6.3 — Information security awareness, education and training | Phishing simulation supports awareness and training activities under the people-controls annex. |
| Recommendation — Use A.6.3 to align simulation exercises with formal awareness and training objectives. | ||
Practitioner Guidance
Governance implication: Treat phishing simulation as a sanctioned security control, not an ad hoc exercise. Give it an owner, define approval boundaries, and make sure the platform cannot be used to send unrestricted messages or collect more data than the exercise requires.
What to watch for: Review whether the programme is measuring meaningful behaviour or only generating click counts. If users learn to ignore simulations, if help desks are being flooded, or if the exercise is capturing sensitive material unnecessarily, the programme design needs adjustment.
Practitioner takeaway: The best phishing simulation programmes are realistic enough to teach, but constrained enough that they never become a security problem of their own.