What a Phishing Simulation Should Never Do

A phishing simulation is a practice email. It looks like the kind of message a fraudster might send, it goes to your own staff with your firm's approval, and it gives people a safe place to notice the warning signs before a real one arrives. Done well, it builds a habit. Done badly, it teaches people that the security program is something to fear, and that lesson is very hard to undo.

This post covers the lines a simulation should never cross, and why each one matters more than it might seem.

Why trust is the whole point

The most valuable thing an employee can do with a suspicious email is report it, quickly, including when they have already clicked. That only happens if people believe reporting will not get them in trouble.

The UK's National Cyber Security Centre (NCSC) says this directly in its phishing guidance: "Users who fear reprisals will not report mistakes promptly, if at all."¹ The same guidance warns that simulations can "erode trust between employees and security" and advises firms to "avoid creating a punishment or blame-oriented culture around phishing."¹

A small firm feels this even more than a large one. There is no anonymous security team down the hall. The program owner is often the office manager or a partner, and staff know exactly who sent the test. Every guardrail below protects that relationship.

1. Never use a theme that plays on real hardship

Some lures work precisely because they hurt: a surprise bonus, a layoff notice, a payroll problem, a medical emergency, a disciplinary meeting, or a current tragedy. Real criminals use all of them. A firm's own practice email should not.

The risk is not hypothetical. In December 2020, a large web-hosting company sent employees a simulated email offering a holiday bonus during the pandemic. Staff who clicked were told they had failed a phishing test and needed to retake training. After the story was widely reported, the company apologized, saying some employees "were upset by the phishing attempt and felt it was insensitive."²

The lesson people took away was not "check the sender." It was that their employer was willing to toy with them. Staff can learn to spot an emotional lure without being put through one that targets their paycheck, their job, or their health.

2. Never collect a real password

Many real phishing emails lead to a fake sign-in page. A simulation can teach that pattern without ever capturing or storing what someone types. If a practice page records real credentials, the firm has created exactly the thing it is trying to prevent: a list of working passwords sitting somewhere it should not be.

It also changes how the exercise feels. "You clicked a practice link" is a learning moment. "We have your password" feels like being caught. A well-designed simulation registers that someone reached the sign-in page and stops there.

3. Never shame anyone in public

No leaderboards of who clicked. No names read out at a staff meeting. No "worst department" slide. Public shaming makes the next mistake more likely to be hidden, which is the opposite of what a firm needs when a real message gets through.

Leadership still needs visibility, but at the right level: participation, trends across themes, how many people reported, and where to focus next. Aggregate reporting gives a managing partner that picture without turning a practice exercise into a performance review. Our sample leadership report shows what that can look like.

4. Never punish a click

The NCSC is plain about this: "Don't reprimand users who are struggling to recognise phishing emails," and "blaming users for clicking on links doesn't work."¹ People click for ordinary reasons. They are busy, the message looks routine, and clicking links is part of their job.

Follow-up should be short, specific, and private: what the warning signs were and what to do next time. It also helps to be realistic about what a single training page can do. In a 15-month study of more than 14,000 employees at a large company, researchers found that showing a training page right after a click did not make employees more resilient to phishing; in some measures, the trained group clicked more.³ The authors suggest a false sense of security as one possible cause. The takeaway is not to skip follow-up, but to treat it as ongoing, supportive practice rather than a penalty. We look at why repetition matters in Why Annual Security Training Doesn't Stick.

5. Never run without written approval and a way to stop

A simulation sent without the right people knowing about it can cause real confusion: an assistant forwards it to a client, IT starts treating it as a live incident, or someone on leave gets a message they never should have. The NCSC also notes that simulations "can also create legal risk" and recommends checking with HR before running them.¹

Before any practice email goes out, someone with authority at the firm should approve it in writing, including the theme, the send window, and who is excluded. There should be named contacts who can stop pending sends, and a clear rule that a real security event always takes priority. Filing deadlines, closings, and hearing dates are not the week to test anyone.

What to measure instead

If click rate is the only number a firm watches, every incentive points toward harsher tests or easier ones. The NCSC suggests that "as well as measuring how many people clicked on a phishing email, focus on how many people reported it."¹

The same long-term study supports that. Over 15 months, more than 4,000 participants reported at least one suspicious email, reports kept arriving at a steady rate, and the researchers found no significant "reporting fatigue."³ Their conclusion was that using employees as a collective detection mechanism is practical. For a small firm, the equivalent is simple: one person who reports a convincing message quickly can protect everyone else who received it.

A one-page guardrail list for this week

Whether you run simulations yourself, through your IT provider, or with outside help, write these down and have a firm leader sign off:

• No themes involving bonuses, layoffs, payroll problems, medical emergencies, discipline, or current tragedies.
• No collection or storage of real passwords.
• No public naming, rankings, or leaderboards.
• No punishment for clicks; follow-up is short, private, and educational.
• Written approval for each campaign, a list of exclusions, named stop contacts, and blackout dates.
• Reporting counts as success, including reports from people who clicked first.

Then tell staff the rules. Knowing the guardrails exist is a large part of what makes people willing to report. For a broader self-check covering account access, payment verification, and reporting, see the Email Fraud Readiness Checklist, and for how these guardrails fit into a full program, see How It Works.