// awareness · guide
Phishing Simulations: Doing Them Without Wrecking Trust
Authorised phishing simulations can support reporting practice and targeted training. They can also undermine trust if they punish or mislead staff without care. Agree objectives, approved recipients, safe payloads, data handling and a stop route before launch.
The wrong way
- Gotcha emails promising bonuses, then publicly shaming everyone who clicked.
- One test a year, treated as a pass/fail exam.
- No follow-up training — just a scary statistic in a board deck.
The right way
- Frame it as team training, not a trap. Announce that simulations happen; the goal is practice, not punishment.
- Make reporting the win. Measure and celebrate the report rate, not just the click rate. Review whether reports reach the right responders and lead to timely action.
- Teach at the moment of the click. The landing page should be a 30-second lesson, not a reprimand.
- Escalate difficulty gradually and tie scenarios to real threats your sector faces.
Metrics that matter
Compare reporting, time-to-report and repeated interaction alongside scenario difficulty, targeting and technical controls. A click rate alone does not establish risk, and a fast report does not guarantee containment. Review trends without naming or shaming individuals. The NIST Phish Scale User Guide explains how scenario difficulty helps interpret exercise results.
Concerned about any of this in your environment?
ABZSECURE helps organisations test, validate and remediate these issues with reproducible evidence, not scanner output alone. Start with a no-obligation conversation.
Published by ABZSECURE.
Discuss your security →