Phishing Simulation: A Breach of Trust or a Necessary Drill?

A phishing simulation is an awareness method in which employees receive fake emails that resemble a real attack, and their reactions are measured. The aim is to build the right reflex when a suspicious message arrives, and catching people out is beside the point. Security leaders are divided on the method, though. In this article we look at both sides, why click rate alone is not enough and how a simulation should be designed.

What do the critics say?

• It creates a trust problem. The tests are built on tricking employees. That can create a hostile relationship between the security team and staff.
• Punishment is not training. Sending someone who made a mistake to a mandatory 20-minute course punishes them; it does not teach them. And people start hiding their mistakes.

These criticisms are fair. A badly designed simulation programme can harm the very security culture it is meant to protect.

What do supporters say?

• You cannot improve what you do not measure. Without simulations there is no way to know how employees would react to a real attack.
• Accountability. After an incident, a security leader may be asked "Why didn't you test?" Auditors and legal processes ask this more and more often.
• A drill, not a trap. Fire drills are not held to frighten people; they are held so people know what to do in a real fire. Simulations exist to build reflexes in the same way.

Where both sides agree: reporting

Both sides of the debate agree on one thing: what matters most is who reports, how quickly and without fear, more than who clicked.

When a reporting culture replaces a blame culture, the trap-or-drill debate loses its meaning. If employees are not afraid to admit a mistake, the simulation becomes a tool for measuring and learning.

Why click rate alone is unreliable

Many organisations measure simulation success by click rate alone. The metric can mislead:

• An easy scenario produces a low click rate and a hard one a high rate. The numbers cannot be read without the scenario's difficulty.
• Academic studies show that persuasion and social engineering techniques work even when the risk is clearly known. People may ignore warnings, especially when shown social proof such as "500 people have already done this".

So knowing is not enough; behaviour has to change. And there is no such thing as 100 percent success. The goal is for the organisation to stop being the easiest target.

Why targeted attacks make simulations necessary

Attackers no longer settle for random emails. In one widely reported case, NASA employees spent years sharing defence software with an agent posing as a colleague. The agent built a fake identity, formed one-to-one relationships and asked them to send the software. Nobody meant any harm. They simply fell for a well-planned trap.

The only way to measure readiness for targeted (spear phishing) scenarios like this is to practise with similar scenarios.

How to design a phishing simulation

1. Announce it. Tell employees there is a simulation programme: its existence, while keeping timing and content private.
2. Do not punish. Give anyone who clicks short, immediate, non-judgemental feedback.
3. Reward reporting. Visibly recognise employees who report suspicious emails.
4. Vary the scenarios. Email, QR code, SMS and phone scenarios each require different reflexes.
5. Match difficulty to role. Use more realistic, targeted scenarios for critical roles such as finance and leadership.
6. Watch the trend. The change over months is what counts, more than the result of a single test.

Frequently asked questions

---
InfoLore designs phishing simulations as a tool for measuring and improving, never for punishing. Get in touch to design your programme.