Key takeaway
A good simulation is realistic, authorized in advance and educational. People receive an explanation when they miss a lure, while results are reviewed without public shaming.
What a simulation measures
A simulation is a harmless training message sent with the organization’s authorization. It provides feedback on recognizing and reporting suspicious mail, but does not replace a separate assessment of technical controls. Design it to record a submission attempt without collecting real passwords or MFA codes. Results inform learning; they do not prove safe behavior during a real attack.
Fit scenarios to the work context
A generic or obvious lure does little to practise real decisions. Match scenarios to the work: a supplier invoice for finance, a password notice for IT or a learning-platform alert in an education setting. Avoid personal crises, intimidation and humiliation. Agree on scope and data use with the organization’s legal, privacy and people teams before launch.
Look beyond the click rate
The NIST Phish Scale helps assess detection difficulty using message cues and recipient context. Agree on a local measurement definition: for reporting and click proportions, divide unique recipients who performed the action by recipients of delivered messages. Keep submission-attempt counts distinct from percentages. Do not use these measures alone to predict real incidents. How to interpret simulation results:
| Measure | What it shows | What to consider |
|---|---|---|
| Reporting proportion | Reporting behavior | Whether the reporting channel is usable |
| Click proportion | Link interaction | Scenario difficulty |
| Submission attempts | Attempted disclosure | No real passwords or codes collected |
| Scenario difficulty | Recipient context and message cues | Compare like campaigns |
Turn results into learning
Give someone who misses a lure short, immediate feedback: what was suspicious about the sender or request, which action would create risk in a real attack, and how to report the message. Review patterns by team or role instead of ranking people by name. Use the findings to target follow-up learning and make it safe to report mistakes.