Key takeaways

  • NIST SP 800-50 Rev. 1 says phishing exercises should not be punitive and no employee should be called out for their response; when treated as learning opportunities they give useful data on vulnerabilities and where more support is needed.
  • The same guide advises telling employees that the organization runs phishing exercises on a random basis and that results guide future learning.
  • It also advises involving the organization's legal team in the design and review, for example to avoid using real brands or naming federal agencies in the bait, which could cause calls or emails to those entities.
  • Realistic does not mean cruel. A lure that mimics a real threat to the business is fair; one that dangles a bonus, a layoff notice or a family emergency is not.
  • Make reporting easy and visible: a one-click report button, quick feedback and a thank-you do more than a click rate.
  • Handle repeat clickers with extra coaching in private, not discipline and not public lists.
  • Settle the groundwork first with HR, legal and works councils or employee representatives where they exist: what is tested, what is recorded, who sees it and how long it is kept.

The risk of getting it wrong

Phishing simulations are common because they work: seeing a realistic lure teaches more than reading about one. They also have a bad reputation, and some of it is earned. Programs that send fake bonus announcements, post lists of clickers or threaten discipline teach staff to fear the security team, hide mistakes and stop reporting real problems. That is the opposite of the goal.

The U.S. National Institute of Standards and Technology addresses this directly in SP 800-50 Rev. 1, its guide to building a cybersecurity and privacy learning program. It says that because employees may not like being tricked, they should be told that the organization conducts phishing exercises on a random basis and that the results will be used to guide future learning activities. It continues that the activities should not be punitive, nor should any employee be called out for their response. Treated as learning opportunities, the exercises show where vulnerabilities are and which staff may need more help.

Before the first email: agree the rules

Do the groundwork with the people who could be affected. Bring in human resources, legal counsel and, where they exist, employee representatives. NIST's guide specifically says the legal team should help design and review the exercises. Write a short policy that answers these questions:

  • What is the purpose? Learning and measuring, not discipline.
  • Who is included? All staff, or a defined set of roles. Say whether executives and the security team are in.
  • What data is kept, who can see it, and for how long? Decide whether results are reported by name to anyone, or only in groups.
  • What will never happen as a result of one click? Say it plainly: no formal warning, no mention in a review.
  • What is off limits in the lure itself? See the next section.
  • Who gets told after a mistake, and how? The employee, in private, with a pointer to help.

Tell all employees, in advance, that simulations will happen at random times, why, and what the rules are. You do not need to give the date. Telling people the program exists is part of consent in spirit, and in some jurisdictions or workplaces it is part of what is required; ask your counsel.

Realistic, but fair

A good simulation looks like the attacks your people actually receive: a shared document request, a mailbox quota warning, a delivery notice, a multi-factor prompt, a vendor invoice, a message that appears to come from a colleague. Use your own sector's patterns and your own tools. A lure that cannot fool anyone teaches nothing; a lure that is impossible to resist teaches helplessness.

NIST's guide points to the NIST Phish Scale as a way to measure how difficult a simulated email is, because it takes the employee's context into account. Difficulty matters: a low click rate on an easy email and a high rate on a hard one say different things, and a month-to-month comparison is meaningless unless the difficulty is similar. Rate each lure, and use a range of levels.

Set limits on content. Avoid:

  • Anything that exploits fear or hope tied to a person's job or life: bonuses, pay cuts, layoffs, health results, family emergencies, disciplinary notices.
  • Real brands and government agencies in the bait. The NIST guide warns that using legitimate brands or naming federal organizations can lead to emails and calls to those entities.
  • Links that lead to anything harmful, and any collection of real passwords. If a landing page has a login form, do not store what people type.
  • Tricks aimed at a single named person unless you are running an agreed exercise for a specific role.

What happens when someone clicks

The moment after a click is the lesson. Show a short, friendly page right away: this was a simulation, here are the three signs you could have spotted, here is how to report the next one. Keep it under a minute. No score, no shaming, no timer.

Do not publish a list of who clicked. Do not tell managers by name unless that was agreed in the policy and they have a real support role. Share group results with leadership: the click rate by department, the report rate, the trend. The goal is to learn where the organization needs better training, not who to blame.

Repeat clickers, treated fairly

Some people will click more than once. Often they are the busiest, the most exposed to outside mail, or the ones using a phone in a hurry. A calm conversation usually reveals why: a mobile mail app that hides the sender, a role where the lures are tuned very close to the job, a lack of time to read. Offer a short one-to-one coaching session or a small targeted lesson. Review whether the lure was harder than the rest. If a person keeps struggling, look at the environment too: stronger mail filtering, links that open in a safe view, hardware security keys that make a stolen password useless.

Reward the report

A simulation program is judged by what staff do when they see a suspicious message. Put a report button in the mail client and tell people it is the right action even for real, harmless mail. Reply fast to every report with a short thank-you and the verdict, real or simulated. Celebrate the first reporter of a real phishing email in a company message. Over time, people learn that reporting is valued and clicking is survivable, and the rate of reporting rises while the rate of clicking falls.

A starter plan

  • Month one: HR, legal and leadership agree the policy; staff are informed.
  • Month two: a baseline simulation of average difficulty, with instant feedback and no names.
  • Months three to twelve: a simulation every month or two, varied in lure and difficulty, with short lessons keyed to what staff actually saw.
  • Every quarter: share group results and the real-world reports with staff, and adjust the program.

The next question is what to measure so that the program shows real progress; a companion article covers that.

Sources

This article is general guidance, not legal advice. Adapt it to your organization, and ask your counsel about employment, privacy and contract questions before you rely on it. Last reviewed .

Next article

Related reading

Need help with this?

Train your people to stop the phish, the fake voice and the wire request before money moves.

Security Awareness Training