Skip to main content

Phishing Simulation Campaigns

Overview​

Phishing Campaigns let you test employee security awareness with realistic phishing simulations. Measure vulnerability, identify training needs, and track improvement over time.

Why Phishing Simulations?​

The Threat​

  • 91% of cyberattacks start with phishing
  • Average cost of a phishing breach: $4.65M
  • Click rates range from 5-30% even in trained organizations

Benefits of Simulation​

  • Measure actual employee behavior
  • Identify high-risk individuals and departments
  • Reinforce training with practical experience
  • Track improvement over time
  • Meet compliance requirements

Campaign Lifecycle​

  1. Plan

    Define campaign goals and target audience.

  2. Create

    Select templates and configure the campaign.

  3. Launch

    Send simulated phishing emails.

  4. Monitor

    Track opens, clicks, and submissions.

  5. Report

    Analyze results and identify trends.

  6. Remediate

    Assign training to those who failed.

Creating a Campaign​

Campaign Setup​

  1. Navigate to Employees → Phishing Campaigns
  2. Click Create Campaign
  3. Configure basics:
    • Campaign name
    • Description
    • Start and end dates
  4. Continue to template selection

Selecting Templates​

Choose phishing templates that match real threats:

CategoryExamples
Credential TheftFake login pages, password reset
Business EmailInvoice requests, executive impersonation
IT AlertsSystem updates, security warnings
SocialLinkedIn, social media notifications
SeasonalHoliday offers, tax season

Template Features​

Each template includes:

  • Email Template - The phishing email content
  • Landing Page - Where clicks lead (fake login, etc.)
  • Difficulty Level - Easy, medium, hard to detect
  • Indicators - What makes it suspicious

Customizing Templates​

Personalize templates with:

  • Company branding (for realistic scenarios)
  • Employee name and department
  • Custom sender information
  • Modified landing pages

Target Audience​

Selecting Targets​

OptionDescription
All EmployeesCompany-wide campaign
By GroupSpecific compliance groups
By DepartmentTarget departments
Random SamplePercentage of employees
Failed PreviousThose who failed before

Exclusions​

Exclude employees who:

  • Are on leave
  • Recently completed training
  • Were recently tested
  • Are in sensitive roles (with approval)

Sending Configuration​

Send Options​

SettingDescription
Send All At OnceAll emails sent immediately
StaggeredSpread over hours/days
Random TimesRandomize delivery times
Working HoursOnly during business hours

Sender Settings​

Configure the "from" address:

  • Use realistic external domains
  • Internal IT impersonation
  • Vendor/partner impersonation
warning

Ensure you have proper authorization before impersonating real companies or individuals.

Campaign Monitoring​

Real-Time Dashboard​

Monitor campaign progress:

MetricDescription
SentEmails delivered
OpenedEmail opened (if tracking enabled)
ClickedLink clicked
SubmittedData entered on landing page
ReportedReported as phishing

Event Timeline​

View individual employee actions:

  1. Email delivered (timestamp)
  2. Email opened (timestamp)
  3. Link clicked (timestamp)
  4. Form submitted (timestamp)
  5. Reported as suspicious (timestamp)

Analytics and Reporting​

Campaign Results​

MetricCalculation
Click RateClicked / Sent × 100
Submission RateSubmitted / Sent × 100
Report RateReported / Sent × 100
Compromise RateSubmitted / Clicked × 100

Comparisons​

Compare results:

  • Against previous campaigns
  • By department
  • By seniority level
  • Industry benchmarks

Trend Analysis​

Track improvement over time:

  • Monthly click rate trends
  • Department improvement
  • Training impact correlation

Reporting Mechanism​

Employee Reporting​

Enable employees to report suspicious emails:

  • Outlook Add-in - Report button in Outlook
  • Gmail Add-on - Report in Gmail
  • Forward to Address - Forward to security team

Report Handling​

When employees report:

  1. Email analyzed (real threat or simulation)
  2. If simulation: marked as "Reported" in campaign
  3. If real threat: escalated to security team
  4. Employee receives feedback

Remediation​

Training Assignment​

Auto-assign training when employees fail:

  1. Enable auto-remediation in campaign settings
  2. Select training course to assign
  3. Set assignment timing (immediately, after campaign)
  4. Configure notifications

Just-in-Time Training​

Immediately after clicking:

  1. Employee redirected to educational page
  2. Shows what they missed (phishing indicators)
  3. Short training module on the spot
  4. Tracks completion

Best Practices​

Start Easy, Progress Harder

Begin with obvious phishing. Gradually increase difficulty as awareness improves.

Test Regularly

Monthly or quarterly campaigns maintain awareness. Annual testing isn't enough.

Vary Templates

Use different scenarios each campaign. Employees learn to spot specific patterns otherwise.

Focus on Education

Goal is learning, not punishment. Use failures as teaching moments.

Celebrate Reporting

Recognize employees who report phishing. Build a culture of reporting.

Compliance​

Phishing simulations support:

FrameworkRequirement
SOC 2CC2.2, CC9.2
ISO 27001A.7.2.2
NIST CSFPR.AT-1

Next Steps​

Data Leak

Monitor for credential breaches

Training

Assign remediation training