Phishing Campaign Design

Phishing simulations are a practical method to measure susceptibility to social engineering and reinforce training. However, poorly designed campaigns can damage trust and morale.

Goals of Simulation

The primary goal is to educate, not to catch people out. Simulations establish a baseline of vulnerability, reinforce prior training in a practical context, and measure actual behavioral change over time. They also help identify specific high-risk groups or topics.

Campaign Types and Difficulty

Campaigns vary in sophistication. Easy simulations use obvious scams with external senders and spelling errors, useful for baselining or fast wins. Medium difficulty involves plausible business scenarios like "Password Expiry" or "HR Update" which are good for regular testing. Hard simulations use sophisticated, context-aware lures targeting specific roles. Spear Phishing involves highly targeted, researched attacks (OSINT) and is typically reserved for high-value targets like Executives or Finance staff, often with prior warning.

Best Practices

DO align scenarios with recent training topics, use realistic but fair templates, and provide immediate constructive feedback ("Teachable Moment") if a user clicks. DON'T shame employees publicly, punish users for falling for a simulation, or use sensitive topics like disasters, bonuses, or layoffs, which can destroy morale.

Key Metrics

Click Rate measures the percentage of users who clicked the link (lower is better, but never zero). Report Rate tracks the percentage of users who reported the email using the "Report Phishing" button. This is the most important metric; a high report rate indicates a proactive defense. Credential Submission measures the percentage who actually entered data, representing the critical risk.

The Teachable Moment

When a user fails a simulation, they should be presented with a landing page that explains it was a test, points out the specific "Red Flags" they missed (e.g., mismatched URL, urgency), and links to a short training refresher.