Automated phishing simulations for new hire onboarding give people safe practice before a real attacker uses the systems, suppliers and urgent requests they will see at work. This 2026 guide explains how to build a constructive program that starts after baseline training and improves with each cohort.
Why this matters
New hires are learning unfamiliar tools, processes and people. That makes an email about a shared file, payroll form, Microsoft 365 sign-in or invoice approval look plausible. Attackers know this and use uncertainty, urgency and apparent authority to push people into clicking or disclosing information.
ASD's ACSC recorded phishing or social engineering in 60% of incidents reported during FY2024–25. The response should not be a harsh test on day one. It should be a staged onboarding sequence that teaches people what a suspicious message looks like, how to report it and what happens after they ask for help.
Cyber Aware phishing simulations offer 100+ templates, click and report tracking, automated follow-up training and a scheduled campaign approach. The platform states that its simulations do not harvest credentials.
Who this is for
This guide is for security leaders, people-and-culture teams and MSPs who need to protect a growing workforce without turning onboarding into a compliance marathon. It works for office staff, remote employees, contractors and frontline teams when each group has an approved route to receive training.
A phishing simulation is a learning tool, not a pass-fail judgment of whether someone belongs in the company. Treat new-hire results as an indication of where the onboarding process needs support.
What to look for in a new-hire phishing program
A baseline lesson before the first simulation
New starters should first receive a short lesson covering phishing red flags, approved reporting channels, password or passkey hygiene, unexpected MFA prompts and how to verify a request. Give them time to complete it within their first 7 days.
Running a simulation before explaining the organisation's reporting process creates anxiety and bad data. A person cannot report what they have never been shown how to report.
Scenarios tied to the actual work environment
Choose simulations based on the systems a person will use. A Microsoft 365 onboarding scenario can use a fake file-share or sign-in request; a finance role can face invoice fraud; a recruiter can see a candidate-document lure.
Cyber Aware can build a year of campaigns around services a client uses and supports segmented campaign sending. Avoid generic consumer-brand messages when they do not resemble the team's real work.
A gradual difficulty path
Start with clear red flags, then move to more realistic messages after people understand the reporting route. Use three stages: obvious urgency and sender mismatch in month one, realistic internal-service messages in month two, and role-specific scenarios in month three.
The point is to build recognition, not to catch people out. Difficulty should increase only when reporting and completion evidence show the group is ready.
Reporting as a success measure
Measure who reports as well as who clicks. A person who reports a suspicious message is strengthening the organisation's detection capacity, even if the message is a simulation.
Cyber Aware's campaign reporting records clicked, reported and did-not-click outcomes, then sends a results report to administrators when the campaign ends. Recognise reporting behaviour in team communication without naming individual results publicly.
Immediate, private coaching after a click
A clicked simulation should lead to an immediate explanation of the red flags and a short follow-up lesson. Cyber Aware describes a workflow that auto-enrols clickers into a failed-phishing course and provides a branded explainer.
Do not send a punitive manager alert as the default. Escalation belongs only where repeated behaviour or a genuine policy issue requires a supportive management intervention.
Clean enrolment and offboarding
A program fails when new starters are not included or former staff keep receiving messages. Use a directory sync, controlled CSV or approved signup process, then reconcile active users with the learner list every week during rollout.
Cyber Aware training supports Microsoft 365 sync, CSV upload and signup enrolment, with welcome emails and scheduled courses. Define an exception route for contractors, leave and users without corporate email.
A 60-day onboarding sequence
Day 1: introduce the reporting culture
During induction, explain that reporting a suspicious email, chat, file share or MFA prompt is expected. Give people the report button, service-desk address or internal route they should use.
Make the message practical: nobody will be punished for asking whether a message is real. Early reporting is the desired behaviour.
Days 1 to 7: complete the baseline
Assign 20-to-30 minutes of training covering phishing, password or passkey protection, MFA prompts, safe data sharing and incident reporting. Use short examples drawn from the tools the new hire will actually use.
Set a due date 7 days after account activation. Send one reminder before the due date and one overdue reminder, with a clear escalation owner for exceptions.
Days 8 to 14: run the first practice message
Send a simple, clearly safe simulation to establish the experience. The message should have multiple obvious red flags and should lead every outcome to a short explanation.
Track whether the person reports it, clicks it or ignores it. Do not over-interpret a single event; use it to show the reporting process and confirm technical delivery.
Days 15 to 30: add a role-specific simulation
Send a scenario tied to the person's function. Finance might receive a supplier banking update, HR a benefits-enrolment request, and sales a document-share prompt from a prospect.
Follow clicks with private coaching and a 3-to-5-minute lesson. Follow reports with positive reinforcement that explains why the message was suspicious.
Days 31 to 45: reinforce the escalation path
Use a short module on what happens after a suspected phishing event: report quickly, preserve the message, do not enter credentials, do not delete evidence and follow IT instructions. Include unexpected MFA prompts and suspicious Teams messages.
ASD recommends phishing-resistant MFA where possible. Technical controls matter, but people still need to know that an unexpected authentication prompt is a warning sign.
Days 46 to 60: review the cohort
Review completion within 7 days, first-simulation report rate, click rate, remediation completion and unresolved exceptions. Compare by role only when the cohort size is large enough to avoid creating a misleading result.
Human risk reporting combines training engagement, failed quizzes and phishing outcomes into a learner-level score. Use this information to guide extra support and to identify process fixes.
What to avoid
- A simulation on a new hire's first morning. Teach the reporting process first.
- Credential capture. A training simulation should not collect real passwords.
- Public leaderboards of clicks. Recognition for reporting is useful; public shaming is not.
- Identical templates every month. People learn the test, not the threat.
- No remediation path. A click without immediate explanation wastes the learning opportunity.
- Missing contractor enrolment. Every user with access needs an appropriate path.
Program comparison
| Approach | Result | Verdict |
|---|---|---|
| One annual phishing test | Delayed learning and stale evidence | Skip |
| Day-one surprise simulation | Anxiety and poor baseline data | Skip |
| Baseline then staged simulations | Builds reporting behaviour and context | Buy |
| Role-specific recurring practice | Best for finance, HR, IT and executives | Buy |
| Click tracking without reporting metric | Misses a key positive behaviour | Hold |
FAQ
When should new hires receive their first phishing simulation?
Run the first simulation after the person has completed baseline training and knows how to report a suspicious message, typically within their first 8 to 14 days.
Should new-hire phishing simulations be difficult?
Start with clear red flags, then increase realism over the first 60 days. The goal is to build a reliable reporting habit, not to produce a high initial failure rate.
What happens when someone clicks a simulated phishing email?
They should see an immediate explanation of the red flags and receive a short follow-up lesson. Cyber Aware states that clickers can be automatically enrolled in a failed-phishing course.
Do phishing simulations capture passwords?
No. Cyber Aware states that its simulations do not harvest credentials; they track who clicked and who reported.
How should managers receive new-hire results?
Managers should receive useful aggregate completion or exception information, not a public list of individual clicks. Repeated risk patterns can be handled through private coaching and process support.
Can contractors join the new-hire program?
Yes. Contractors should have a defined enrolment route, baseline due date and offboarding process. Their access level should determine the depth of training.
One last thing
A new-hire phishing program works when a person who receives an odd message on day 12 knows exactly what to do on day 13: stop, report, preserve the message and ask for help.