Category hub: Social engineering and human risk

In one sentence: A phishing simulation is a safe, fake phishing email sent to your own staff to see who clicks, so you can help them spot the real thing.

What is a phishing simulation?

A simulation copies the style of a real scam but does no harm. When someone clicks, they land on a page that explains what happened and offers training. When someone reports it, they get thanks.

The NPSA and NCSC publish joint guidance on defending against social engineering emails, including a guide on how to design phishing simulations to test how susceptible your organisation is to spear phishing. The goal is to learn and improve. It is not to catch people out.

How it works

1. You choose a lure that matches real threats, such as a parcel notice or a shared document.
2. You send it to a group of staff.
3. The tool records who opens it, who clicks, who enters details and who reports it. Microsoft’s tool lists actions such as delete, report, open the payload and enter credentials.
4. People who click see a short lesson. Positive messages go to those who report.
5. You review the results, then repeat with new lures.

A simulation tests people and your reporting habit. It does not fix technical gaps such as missing multi-factor authentication.

Who it affects and how badly

Every organisation with email has staff who can be phished.

• Sole trader to 10 staff: a quick test for the whole team shows whether anyone would hand over a password.
• 10 to 50 and 50 to 250 staff (accountancy, recruitment, care providers, schools): results show which teams need extra help, such as finance and reception.
• 250 plus and regulated firms: regular testing gives you a record of awareness effort to show auditors and clients.

Real examples

The NPSA’s “Don’t take the bait” campaign provides posters, an animation, a quiz and a guide on designing simulations for organisations: NPSA campaign page. Microsoft documents its own built-in tool, Attack simulation training, in Defender for Office 365 Plan 2.

How to detect it

This entry is about a test rather than an attack, so “detecting” means measuring:

• Click rate, credential entry rate and, most useful, report rate.
• Repeat clickers. Microsoft’s tool defines a repeat offender as a user compromised by consecutive simulations.
• Time to first report. A quick report gives an early warning.

How to fix or prevent it

1. Tell staff that simulations happen and that reporting, even after a click, is welcome. The NCSC advises not to reprimand users who struggle to recognise phishing.
2. Make reporting one click, using the report button in the mail client.
3. Use realistic, varied lures, including QR codes and attachments.
4. Run tests regularly and follow clicks with short training.
5. Pair testing with controls: multi-factor authentication, email filtering and SPF, DKIM and DMARC.
6. Use a licensed tool. Microsoft’s Attack simulation training needs Microsoft 365 E5 or Defender for Office 365 Plan 2.

Related terms

• phishing
• spear-phishing
• quishing-qr-code-phishing
• security-awareness-training
• social-engineering
• whaling

Frequently asked questions

What is a phishing simulation?
It is a safe, fake phishing email sent to your own staff to see who clicks, so you can help them spot the real thing.

What should a phishing simulation measure?
Click rate, credential entry rate and, most useful, report rate, along with repeat clickers and time to first report.

Should staff be told off for clicking?
No. The NCSC advises not to reprimand users who struggle to recognise phishing, and reporting after a click should be welcome.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.

Service page: Phishy phishing simulation.