Phishing Simulation Defined in Plain Terms
A phishing test, also called a phishing simulation, is a controlled fake phishing message that an organisation sends to its own staff with permission to measure how people respond and to teach safer habits. No real attacker is involved and no one is tricked for profit. It is a training and measurement tool, not an attack.
It matters because phishing is how most attacks start. The European Union Agency for Cybersecurity found that phishing was the leading way attackers gained their first foothold, about 60% of initial intrusions across the EU in its 2025 Threat Landscape. The people who receive those emails are therefore part of the control and a phishing test is how you find and close that gap before a real attacker does.
How a Phishing Simulation Works
A phishing simulation tool, or an internal team, sends a realistic but harmless lure to a chosen group of staff. The platform records what each person does, whether that is opening the message, clicking the link, typing a password into a fake login page or reporting it. Anyone who falls for it sees a short teaching page straight away and the results feed a simple report.
A phishing exercise run once tells you very little. A programme repeats the test on a schedule so you can watch behaviour change over months rather than guess at it. Some email and security platforms now include a built-in attack simulation training feature and ready-made templates make a basic test cheap to run.
The same ease helps the attackers. ENISA notes that phishing-as-a-service kits have industrialised real phishing, letting anyone launch a convincing campaign. Safe, internal testing is one way to keep pace with lures your staff will actually meet.
Types of Phishing Simulations
A good phishing awareness test does not just send one easy email. Attackers use every channel so a mature programme mixes these formats.
- Email phishing test: The standard simulated scam email to the whole workforce, your baseline measure.
- Spear-phishing and whaling simulation: A tailored lure aimed at a named person or a senior leader, testing the high-value targets attackers research.
- Smishing test: A simulated scam sent by SMS or text, for staff who work mostly from a phone.
- Vishing test: A simulated phone call often paired with an email, testing how people hold up under live voice pressure.
- Quishing test: A simulated scam that hides the link inside a QR code, a fast-growing format that slips past link filters.
- Attachment and credential-harvest lures: Tests built around opening a file or typing a password into a fake login page, the two actions that cause most of the damage.
ENISA lists vishing, smishing, spear-phishing and QR phishing among the social-engineering vectors in use today so testing only plain email leaves the channels attackers prefer untested.
The Business Case and the Metrics That Matter
Three numbers make the case. Phishing is the leading intrusion vector at about 60% of EU cases (ENISA, 2025). The human element features in about 60% of breaches worldwide (Verizon Data Breach Investigations Report, 2025).
And it is fast. In the 2024 Verizon report the median time to click a phishing link after opening the email was 21 seconds with data entered 28 seconds later so a phish can succeed in under a minute. Technology alone cannot close a gap that opens that quickly.
A phishing test turns a guess about your people into a measurement. The trick is choosing the right numbers.
- Click rate: The headline figure but weak on its own. It never reaches zero and it moves with how hard the email is so an easy lure lowers it without any real improvement.
- Report rate: The share of people who flagged the message. This is the number that matters because a reported phish warns the whole organisation. In the 2024 Verizon report, 20% of users reported phishing in simulations and 11% of those who clicked reported it too.
- Time to report: How fast the first report arrives since detection speed decides how much damage a real campaign does.
- Repeat-clicker rate: The small group who fall for it again and again where targeted help pays off most.
Real-World Cases
The clearest lessons about phishing tests come from ones that went public. Two show how a badly chosen lure backfires and one shows what rigorous evidence says actually works.
West Midlands Trains, 2021
In April 2021 the UK rail operator West Midlands Trains emailed about 2,500 staff, mostly office and manager grade, a message from Finance and Payroll thanking them for their work through the pandemic and promising a one-off bonus with a link to claim it.
Anyone who clicked was told it had been a phishing simulation test. The rail union TSSA condemned it as a ‘cynical and shocking stunt’ (The Guardian, 2021). The problem was the bait, not the test. A promise of pay during a hard year is cruel bait and a quick check with HR and staff representatives before launch would have flagged it.
GoDaddy, 2020
In December 2020 the web company GoDaddy sent staff a Holiday Party email promising a $650 bonus and asking for personal details. It was a phishing test and about 500 employees failed it, months after the company had cut jobs during the pandemic.
GoDaddy apologised publicly, calling the test insensitive and saying it needed to be more sensitive to its staff (CBS News, 2020). The apology was the right move, but it shows the order of events. Trust is spent first and recovered slowly. Keep lures away from pay, jobs and other sensitive themes.
The ETH Zurich Study, 2022
Researchers at ETH Zurich ran a 15-month study of more than 14,000 employees and published it at the IEEE Symposium on Security and Privacy. It tested what changes behaviour and two findings stood out.
Voluntary click-through training, the short page shown after someone fails, did not improve resilience and in their setup left people slightly more likely to click. A one-click report button, by contrast, worked well, with staff reporting steadily over months and no sign of fatigue (Lain, Kostiainen and Capkun, 2022). The evidence points at reporting and clear warnings so build for those rather than for a lecture after the click.
Phishing Simulation and Compliance
Security awareness training is a legal measure, not a nice-to-have. NIS2 Article 21(2)(g) requires basic cyber hygiene and cybersecurity training and in Sweden this is law under Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026. Under Article 20 the board is responsible for security measures and can be held personally accountable. A phishing test is a practical way to deliver that training and to evidence it.
A simulation also rehearses the reporting reflex the law itself depends on. Sweden’s incident cascade to MCF (formerly MSB) runs to a 24-hour early warning and a 72-hour notification and those deadlines only hold if staff report fast in the first place.
For financial entities, DORA Article 17 covers ICT incident management process, and Article 13 covers the security awareness and training that supports it, both supervised in Sweden by Finansinspektionen.
Mind the staff data too. A test records who clicked and who reported which is personal data so it needs a lawful basis and must stay proportionate under GDPR. The UK NCSC warns that punishing people for clicking emails you sent can stray into legal risk so agree the purpose and the handling of results with HR before you start.
How to Run a Phishing Simulation Programme
A phishing test is only useful as part of a programme. The shape that works is consistent across good practice and the research.
- Take a baseline, then run on a regular cadence, monthly or quarterly. A one-off test is theatre and behaviour change only shows over time.
- Vary the difficulty and the channel and segment by role so finance and senior leaders meet the tailored lures real attackers use on them.
- Pair every failed test with short, useful feedback at the moment of the click and make the report button one tap on every device.
- Measure report rate and time to report and treat click rate as context rather than the target.
Be honest about the limit. The UK NCSC is blunt that no training package, phishing simulations included, can teach people to spot every phish and that spotting them is not most people’s job. The goal is a fast reporting reflex with strong technical controls behind it, not a click rate of zero.
Common Mistakes and Best Practices
Most phishing tests fail for the same handful of reasons. Avoid them and the programme earns its place.
- Align HR, legal and staff representatives before the first campaign, on the purpose, the privacy and how results will be used.
- Choose ethical lures. Never bait people with bonuses, pay or job security, the themes that caused the backlash above.
- Reward reporting and coach anyone who clicks. Do not punish or name individuals because blame drives mistakes underground.
- Pair every simulation with brief training and give one obvious reporting route, not a hunt through menus.
- Track report rate and time to report as your main numbers and watch repeat clickers rather than the headline click rate.
- Progress the difficulty and cover smishing, vishing and QR lures, not just easy email.
- Handle the staff data you collect lawfully and keep it proportionate.
- Put technical controls behind the people such as multi-factor authentication, email authentication and filtering so a single click is not a breach.
Training is the other half of the job. A test measures the habit and regular security awareness training built around reporting rather than blame is what builds it.
A phishing test is only worth running if it changes what people do next. Build a reporting habit, back it with strong controls and your biggest attack surface starts working as an early-warning system.
