Phishing Simulations

Written authorisation from someone in your organisation empowered to give it, before a single message is sent. A simulation puts deceptive mail in front of your own staff under your own name, so the decision belongs to the business rather than to a supplier. In the scoping call, a 30 to 45 minute conversation, we agree the audience, the exclusions, the tone limits and the sending window with the security or IT owner and with HR and leadership, and those terms go into a written scope with a timeline and a fixed price before work begins. From you we need a named approver for the scenarios, a mail team who can allowlist our sending domains, and a service desk briefed to handle genuine reports properly. We do not ask individual recipients to consent in advance, because a pre-announced campaign measures nothing useful. The authorisation sits with the organisation, and it is on paper.

Four behaviours per scenario, plus one timing. We record who opened, who clicked, who submitted details on the landing page and who reported the message, and we measure how quickly the first report reached your service desk. Click rate alone is the easiest number to move and the weakest signal, because scenario difficulty shifts it as much as behaviour does, so each scenario is rated with the NIST Phish Scale and results are broken down by team, role and difficulty rather than published as one organisational figure. Submission is counted separately from clicking, since the two carry different risk and need different follow-up. Reporting speed matters because a fast report is what turns a click into a contained incident. The Campaign Results Report sets each of these against your baseline and the rounds before it. Our guide to phishing simulation services in India goes further into which metrics predict resilience.

Monthly or quarterly, agreed at scoping and then held steady. The first campaign is a baseline rather than a score: it tells you where you stand and nothing about whether you are improving. Meaning arrives at the repeat, when the same group meets a comparable scenario later and the Improvement Trend Report shows the difference between the two rounds. Scenario difficulty rises as performance does, which is why the Phish Scale rating travels with every result; a falling click rate against easier lures is not progress. A single campaign has its uses, as an audit artefact or a first look, and we will run one, but it is honest to say it produces a snapshot that fades rather than a change in behaviour. Cadence is what makes this work, and the rhythm matters more than the frequency you pick.

Individual behaviour is captured, because targeted training needs it, but it is not what we report. Results are aggregated by team, role and scenario before they reach you, so the Campaign Results Report shows where risk sits without naming anyone. Real credentials are discarded at the point of capture and never stored or passed on, so a submission is recorded as an event rather than as a password. The framing is practice, not punishment, and the tone limits agreed with HR and leadership in phase one are a scope boundary, not a courtesy. We will not supply a per-person leaderboard or a ranked list for management review, because programmes that do it stop getting reports, and the report rate is the number worth protecting. If you want individual data for your own purposes, that is a decision to take deliberately, with HR involved.

They get a short training module immediately, on the landing page, explaining the specific cues that gave that lure away while the moment is still fresh. Nothing is sent to their manager and no disciplinary step follows from us. The landing pages are ours, no live system is touched, and anything typed into a credential field is discarded at capture rather than checked or kept. The same group meets a comparable scenario in a later round, and the improvement between the two is reported. What this service does not include is a full awareness curriculum: the follow-up here is a few minutes tied to one click, and broader training for your whole workforce is a separate service, Awareness Trainings, in this practice area. A genuine report from a colleague goes to your service desk as usual, which is why we brief them before launch.