We hear constantly about advanced attacks run by organised groups with sophisticated tooling and AI. The awkward truth is that most of the time the thing that opens the door to a company's servers isn't a technical flaw - it's one rushed click by one employee.
In the work I do, the same scene repeats: a company spends real money on firewalls and endpoint protection, then leaves the human factor to chance. And that human factor is where the real breaches actually start - stolen logins and pasted commands, not movie-style zero-days. That's why a phishing simulation isn't a luxury. It's basic hygiene, like testing your smoke alarms.
What a phishing simulation is, and what it isn't#
Think of it as a controlled fire drill for your inbox. We don't actually attack your systems. We send your staff realistic - but harmless - phishing emails in a safe, measured way. A fake "unpaid invoice," a "you must reset your password" notice, a "bonus list" attachment: the kinds of lures real attackers use.
The point is not to catch people out or embarrass whoever clicks. It's to measure your organisation's real exposure and teach people to spot the warning signs before it counts for real. A simulation that's run as a "gotcha" breeds fear and quiet non-reporting, which is worse than doing nothing. Run properly, it's blameless by design.
Why the old annual training doesn't cut it anymore#
Plenty of managers tell me, "but we did a security presentation last year." A one-off talk is forgotten by the next morning. Practical simulation works better for three concrete reasons.
1. AI changed the rules#
The days of spotting phishing by clumsy grammar or ugly design are over. Attackers now use large language models to produce flawless, personalised messages that mirror the writing style of your manager or a known supplier - and they do it in any language, at scale. "Look for bad spelling" is dead advice. Simulations show staff what today's genuinely convincing lures look like, so recognition is based on structure and context, not typos.
2. It builds muscle memory#
People learn best from their own mistakes - safely. When someone clicks a simulated (harmless) link, they get an immediate, short, interactive lesson: here's what you missed, here's the tell you should have caught. That moment sticks in a way a slide deck never does. Repeat it a few times and caution becomes a habit rather than a rule someone once heard.
3. It gives leadership real numbers#
After each run you get a report with hard data instead of a gut feeling:
- What percentage of staff opened the email?
- How many clicked the link or entered credentials?
- Which departments (finance, HR, support) are most exposed?
That lets you target training where it's actually needed, and show measurable improvement over time rather than assuming it.
What a professional service looks like#
Good security isn't a one-off event, it's an ongoing process. A proper phishing simulation programme has a few parts.
- Tailored scenarios. Emails are built around your business. A logistics firm gets fake parcel-tracking links; a finance team gets spoofed bank or tax-authority notices. Generic templates get ignored; specific ones test reality.
- Regular cadence. Attacks are simulated on a schedule - say quarterly or monthly - so vigilance doesn't fade back to zero between runs.
- Rising difficulty. Over time the lures get harder and more targeted, and the click rate should drop steadily. That downward curve is the whole point.
One caution worth stating plainly: the goal is a lower click rate over time, not a zero click rate this quarter. Chasing zero pushes teams toward punishing people, which kills reporting. A team that reports a suspicious email quickly is worth far more than one too scared to admit a mistake.
What a typical first year looks like#
To make it concrete, a realistic programme for a small company might run like this:
- Baseline run: a first, unannounced simulation to measure where you actually stand. A click rate of 20-30% on the first run is common and nothing to be ashamed of - it's the number you improve from.
- Quarterly rounds: each with a short, immediate lesson for anyone who clicks, and lures that get a little more targeted each time.
- Reporting habit: you track not just who clicks, but how many people report the email - the metric that actually predicts resilience.
- By the fourth round: click rates in the single digits and a reporting rate that climbs each quarter are a realistic, healthy trajectory.
Numbers vary by team and starting point - the shape of the curve (clicks down, reports up) matters more than any single figure. This is the same discipline behind consumer-facing scams like smishing: recognition beats memory.
The metrics that actually matter#
Click rate is the number every vendor puts on the front of the report, and on its own it's close to a vanity metric. It's easy to move in the wrong ways - send an obvious lure, and it drops. Here's what a report should carry instead, and what each one is really telling you.
| Metric | What it means | What good looks like |
|---|---|---|
| Report rate | How many people flagged the mail to IT | Rising every round; ideally above the click rate |
| Time to first report | How fast your first warning arrives | Minutes, not hours - it's your incident-response head start |
| Credential submission rate | Who went past the click and typed a password | Falling faster than click rate; this is the one that maps to real loss |
| Repeat clickers | The same handful of people, every round | A coaching problem, not a discipline problem |
| Department spread | Where exposure concentrates | Finance, HR and support carry more risk by role, not by carelessness |
Report rate is the one to manage to. A team where 40% click but the first report lands in four minutes is in better shape than one where 5% click and nobody says a word - because in the real incident, the reported email is what lets you reset a session, revoke a token, and pull the message from every other inbox before anyone else opens it.
Time to first report is the metric with an operational payoff. Every minute between the first click and the first report is a minute an attacker has with a live session. If you measure only one new thing after your baseline run, measure this one.
And watch what happens to repeat clickers. If the same three people click every round, the answer is a short conversation and a different lure next time - not a performance note. The moment a simulation carries a career consequence, people stop reporting their own mistakes, and you lose the early warning that made the programme worth running.
What a simulation won't fix#
Worth saying plainly, because plenty of providers won't: training the human is not a substitute for the controls behind them. A simulation reduces how often someone clicks. It does nothing about what happens after the click.
- It won't stop credential theft on its own. Modern adversary-in-the-middle kits proxy the real login page and steal the session cookie after a correct password and a correct one-time code. The fix is phishing-resistant MFA - passkeys or hardware keys, where the credential is cryptographically bound to the real domain and simply won't hand itself to a proxy.
- It won't catch the attacks that never touch email. ClickFix lures and abused remote-access tooling arrive through a web page or a compromised supplier, not your mail gateway.
- It won't do anything about the accounts nobody owns. Service accounts, API tokens and shared logins can't be trained, and they usually hold more standing privilege than the staff can.
- It won't replace the boring work. Tested backups, patching, least privilege and session limits still decide how bad a successful phish gets.
Run alongside those, a simulation earns its place: it shrinks the number of incidents, and it buys you the early report that makes the rest of your security programme work faster. Sold as a replacement for them, it's theatre.
The real takeaway#
Security doesn't start with technology, it starts with culture. When your team knows how to recognise a scam and feels safe reporting one, they stop being the weakest link and become your strongest wall.
Don't let the first real attack be the lesson. Invest in prevention and let your people make their mistakes safely - during a drill, not during a breach.
Summary#
- Run a blameless baseline first. An unannounced first round tells you where you actually stand; 20-30% clicking is normal and is the number you improve from.
- Measure report rate and time to first report, not just clicks. Those are the two that change how a real incident goes.
- Tailor the lures to the business. Parcel tracking for logistics, spoofed tax notices for finance - generic templates test nothing.
- Keep a cadence and raise the difficulty. Quarterly rounds with a short lesson at the moment of the click, getting harder each time.
- Never attach consequences to clicking. The moment it affects someone's record, reporting stops and the programme is worth less than nothing.
- Coach repeat clickers, don't punish them - it's a small group and a short conversation.
- Pair it with controls that survive a click: passkeys or hardware keys, short sessions, tested backups, least privilege.
Curious whether your human firewall actually holds? Get in touch for an initial consultation and a phishing simulation scoped to your team.