How to create compelling phishing attack simulations for employees

‍The why

Before you cast the net, decide what you’re phishing for. Are you testing general security awareness? Evaluating employee responses to a specific phishing attack simulation or reinforcing a new company policy? 

Defining your objectives will help shape a phishing simulation that delivers meaningful insights that can lead to improvement.

‍
The how

Cyber criminals use psychological triggers, or social engineering to catch people out, and your phishing simulations should replicate these tactics to be effective.

• Urgency and scarcity

Phishing emails thrive on pressure. Use subject lines like "Urgent: Your Account Will Be Locked in 24 Hours" or "Final Notice: Claim Your Reward Now!" to simulate real-world threats that compel immediate action.

• Sender impersonation

The best phishing emails come from ‘trusted’ sources, mimicking a BEC/VEC attack or simply impersonating internal departments (IT, HR, Finance) . Even using a name similar to a real colleague can add credibility.

• Content mimicry

A convincing phishing attack simulation email looks like the real deal. Use professional language, official branding, and formatting that mirrors actual corporate communications. However, leave subtle giveaways, like small typos or slightly altered URLs to reward employees who pay close attention. It’s important to also keep in mind that each employee will have a different level of sophistication when it comes to how to spot a simulation. A best practice that helps with your executive reporting is to escalate the phishing tests accordingly to keep them on their toes.

• The call to action

Most phishing attempts aim to get the recipient to take action, just like a legit marketing email - click a link, download an attachment, or provide information. Your simulations should include realistic, clickable elements that lead to mock landing pages designed to track user interactions.

How to be transparent about phishing attack simulations to employees

• Inform employees beforehand

Clearly communicate to employees that they will be receiving simulated phishing emails as part of a security awareness training program. We like to run a high sophistication test first to gauge the risk factor, however this is a no fault and no repercussions test (As they all are other than some gentle micro-lessons!)

Clearly state the reason behind the simulations, emphasising that they are meant to educate and improve their ability to identify real phishing attempts, not to catch them out. Assure employees that there will be no negative repercussions for clicking on a phishing link in a simulated email, as the focus is on learning and improvement.

‍

A word on ethics

Phishing attack simulations should educate, not humiliate. While realism is crucial, avoid tactics that could cause panic or distress. Instead, create scenarios that encourage learning and open discussion.

Empathy in choosing content is important, as actually using your employees' circumstances against them will lead to discord and contribute to a stressful work environment

‍

‍

Remember: Employees Are Your First Line of Defence
‍
By equipping your employees with the skills to identify and report phishing attacks, you’re reinforcing the strongest link in your organisation’s cyber security chain. Phishing might be the most common cyber threat, but with the right training, your team won’t take the bait.

‍