In plain English
Phishing simulations are safe, controlled tests of your team's ability to spot phishing. Employees who click the simulated phish are immediately redirected to a short training module rather than punished. Over time, regular simulations — varied in theme and sophistication — measurably improve the proportion of staff who correctly identify and report real phishing attempts.
Full definition
A simulation sends a fake phishing email to your staff, crafted to look like the real thing: a spoofed Microsoft login prompt, a fake invoice from a known supplier, or an HR notification about payroll. Employees who click are taken to a short training page rather than anything harmful. The security team gets a report showing who clicked, who reported the email, and who ignored it.
This works better than a once-a-year awareness video because of immediacy. When someone clicks a simulated phish and lands on a training page right then, the lesson is concrete. Over a 12-month program with varied templates, click rates typically drop measurably across the organisation. includes Attack Simulator for exactly this purpose, making it accessible without a separate vendor relationship.
Template design matters. Early simulations often use obviously fake emails to build confidence, then graduate to more convincing scenarios: a CEO asking for an urgent wire transfer, or a sharing notification with a credential-harvesting link. The goal is not to catch people out repeatedly. It is to calibrate your team's actual risk level and track whether training moves that number. Organisations with high click rates on simulated should treat it as a signal that current controls are insufficient, not just a training gap.