For most small and mid-sized teams, going from decision to a live first phishing simulation takes under one working week — Cyber Aware's own setup runs to “live, in minutes” for the portal itself, and the first campaign can be scheduled for the same week you enrol staff. The part that takes real time is not setup at all: it is choosing sending groups and a difficulty ramp that fits your team. Roll the cadence out monthly from there, and the programme runs itself with automated reminders, auto-enrolment on click and a results PDF after every campaign.
How long does it take to roll out phishing sims to a team?
The typical timeline, start to first campaign:
| Step | Time | What happens |
|---|---|---|
| Enrol staff | Minutes to 1 day | Learners sync in via Microsoft 365 or Google Workspace, arrive by CSV upload, or self-enrol through a signup link — each lands in the default training schedule with a welcome email |
| Set sending groups | 1-2 hours | Split the team into groups (finance, leadership, all staff) so campaigns can be sent separately |
| Build the campaign calendar | Under 1 hour | Cyber Aware's setup chatbot asks which services your company uses internally, then schedules 12 months of varied phishing campaigns from that one conversation — or set send dates, groups and templates manually |
| First campaign live | Same week | Send when the first scheduled date arrives |
| First results read | After campaign close | Who clicked, who reported and how it trends, compiled into a branded PDF that auto-sends to admins |
What actually takes the time — and what doesn't
The misconception worth clearing up first: the software is not the long pole.
- Enrolment is a sync, not a project. Directory sync or a CSV upload brings every learner in at once, and new starters added later are picked up automatically and enrolled on arrival.
- Campaign planning is a single conversation. The chatbot route builds a full year of monthly campaigns in one setup — the alternative, hand-picking a template and a send date each month, is what makes rollouts drag elsewhere.
- Deciding the difficulty ramp is the honest work. Templates range from easy-spot to hard-to-detect, and choosing a progression that fits your team's experience level is the step that deserves an hour of thought.
- Internal sign-off varies most. One approval conversation about how simulation results will be used (coaching, not punishment) routinely takes longer than the technical setup.
A rollout that works, step by step
- Connect your directory. Sync Microsoft 365 or Google Workspace, or upload a CSV. Every learner lands in the programme with a welcome email; leavers are removed cleanly.
- Create sending groups. At minimum: all staff, finance, and leadership. Segregated groups let you send harder templates to the people most targeted, and see results per group.
- Schedule the year. Answer the chatbot's questions about which tools the team uses (Microsoft 365, Xero, Slack, Dropbox and similar) so the templates impersonate the software your staff actually see.
- Ramp the difficulty. Start with easy-spot templates in month one, then escalate toward realistic credential and invoice-fraud lures as report rates climb.
- Decide the click response before the first click. Anyone who clicks a simulated email lands on a branded explainer and is auto-enrolled into a failed-phishing course automatically — decide how managers will frame that before launch so it reads as coaching.
- Read the first results as a baseline. First-campaign click rates are usually the highest you will ever see. Cyber Aware's published benchmark is an average 80% reduction in clicked links within the first eight months on the monthly cadence, so treat month one as the floor, not the verdict.
What slows a rollout down
- Waiting for a “perfect” template list. A varied library of 100+ templates means the first campaign can launch with the templates you have; refine later.
- Annual-only testing. One campaign a year measures a moment. Monthly cadence is what produces the quarter-on-quarter improvement the benchmark numbers come from.
- No report button in place. Pair the rollout with a report-a-phish button (Outlook and Gmail add-ins are supported) so reporting is celebrated from campaign one, not introduced months later.
- Rolling it out client-by-client without a template. For MSPs: set the schedule once for a model client, then replicate the same calendar structure across the rest of the portfolio.
After the rollout: what runs on autopilot
Once the year is scheduled, the recurring work is largely automated:
- Campaigns send on the calendar you set; admins receive the results PDF automatically when each completes.
- Clickers are enrolled into remediation training without an admin sending anything.
- Every failed simulation feeds the Human Risk Score, so risk reporting accumulates as the programme runs.
- Reporting trends (click, report, completion) sit ready for quarterly reviews rather than being rebuilt each month.
That last mile is the reason the rollout is measured in days, not weeks: the ongoing programme needs far less effort than the initial one.
FAQ
How long does it take to roll out phishing simulations to a small team? Under one working week for most teams — enrolment is a directory sync or CSV upload, and the campaign calendar is built in a single setup conversation. The first campaign can be live the same week.
Do we need IT staff to run the rollout? No. Directory sync handles enrolment automatically, campaigns are scheduled once, and remediation is auto-assigned. The only recurring decision is how hard each month's templates should be.
How soon after rollout will we see results? Expect the first-campaign numbers within days of the send, but treat them as a baseline. Meaningful improvement shows over the following months — Cyber Aware's benchmark averages an 80% reduction in clicked links by month eight.
What should we do before the first simulation sends? Tell staff a simulation programme is starting and how clickers will be handled. Announcing the programme (without the dates) keeps the measurement honest and prevents the first campaign being read as a trap.