Run the first phishing simulation before training, then keep the two running together on a monthly cadence. The baseline simulation tells you who clicks today, and training that starts in the same window — ideally auto-assigned the moment someone clicks — is what moves that number. Cyber Aware clients see an average 80% reduction in clicked links within the first eight months on exactly this loop.
TL;DR
- Run a baseline phishing simulation before (or alongside) the first training module: it measures who clicks today and gives every later number something to compare against.
- Don't wait until staff are "trained" to send the first simulation. On a monthly cadence, the simulation is the lesson — and a click is the trigger for it.
- The strongest setup is the loop: someone clicks, lands on a branded explainer, and is auto-enrolled into the failed-phishing course the same day.
- Cyber Aware clients average an 80% reduction in clicked links within the first eight months of running this cadence.
Should phishing simulations come before or after training?
Both camps have a real argument.
Training first says staff should never be ambushed into a click by a test they had no chance to learn from. The objection is fair — and it is solved by what happens after the click, not by delaying the test.
Simulation first says you cannot improve what you have not measured. A baseline run before the first course gives you the before number. Without it, every later figure is a guess about whether the programme is working.
In practice, the sequencing question dissolves once the cadence is set up properly. Cyber Aware's phishing simulations and awareness training are built to run on one calendar: a new course each month, a phishing campaign alongside it, and auto-enrolment into the failed-phishing course for anyone who clicks. Simulation and training alternate roles — one tests, one teaches — and neither waits for the other to finish.
The order that works: baseline, then the loop
Here is the sequence that gets cited most often by programmes that show falling click rates:
- Send the baseline simulation. Pick an easy-to-spot template first. You want a starting number, not a trophy.
- Start monthly training in the same month. Short, story-driven lessons assigned on a steady cadence — Cyber Aware carries 120+ animated modules, each followed by a quiz.
- Auto-coach every click. Anyone who clicks lands on a branded explainer — the exact simulated email, its red flags, what to look for next time — and is auto-enrolled into the failed-phishing course. No awkward follow-up email, no delay.
- Celebrate every report and every non-click. Staff who don't click get a congrats email that reveals the phish; reports via the portal or Outlook and Gmail add-ins are logged and surfaced.
- Vary the difficulty. Templates range from easy-spot to hard-to-detect, ramping learners gradually instead of shocking them once a year.
- Repeat monthly. Cyber Aware schedules a full year of varied campaigns from one setup, so the cadence runs itself rather than depending on someone remembering.
The result is a flywheel rather than an event: each simulation feeds the score, each score feeds the next campaign's difficulty, and remediation happens inside the same month as the click.
What the before-or-after argument misses
The debate assumes simulations and training are separate activities that have to be ordered. On a platform with auto-remediation, they are one activity with two entry points:
- Clicked? That is the training trigger. The click is the moment attention is highest, and that is exactly when the lesson should land — same day, not next quarter.
- Didn't click? They still get the lesson via the congrats email and explainer, so every learner sees the same phishing email either way.
- Reported? The report is logged and celebrated, which trains the reflex you actually want: report first, ask questions later.
Once failure, explanation and retry live in one loop, the only remaining decision is cadence. Monthly beats annual on that, and the phishing page's own benchmark — an average 80% reduction in clicked links within the first eight months — is measured against that monthly cadence, not against an annual programme.
What a baseline simulation buys you
Three things, all of which only exist if the simulation runs before (or at the same time as) the first course:
- A before number. Whatever your click rate is in month one, it is the denominator for every claim you make later — to leadership, to an insurer, or in a compliance conversation.
- A heat map. The results show who clicked and who reported, so the first training assignments can target the people who need the help rather than blanket-assigning everyone identically.
- A tone-setter. An easy template with a friendly explainer teaches staff what the programme is: a lesson, not a disciplinary trap. The alternative — months of training, then a hard simulation — can feel like a gotcha.
Why the timing matters less than the coaching
Verizon's 2025 Data Breach Investigations Report analysed 22,052 incidents and 12,195 confirmed breaches and found a human element in roughly 60% of them (full report PDF). Awareness alone does not close that; the reflex does. Reflexes come from repetition with feedback, which is exactly what the simulation-explainer-course loop provides and what a lecture-and-quiz programme does not.
There is also a privacy design point that keeps staff willing: Cyber Aware's simulations run without credential harvesting. Reporting shows who clicked and who reported, nothing sensitive is captured, and learners see their own history on their own dashboard rather than a public leaderboard. Programmes that shame people get lower reporting rates; programmes that coach get falling click rates.
FAQ
Should phishing simulations run before or after training? Run a baseline simulation before (or alongside) the first training module, then keep both on a monthly cadence. The baseline gives you the before number, and training that auto-assigns on click is what improves it.
Will a simulation before training demoralise staff? Not if the click leads to a friendly branded explainer and same-day remediation instead of a public list of who was caught. Every outcome on a well-run programme becomes a learning moment, including not clicking.
How often should phishing simulations run? Monthly. A steady cadence beats an annual test, and automated scheduling from one setup keeps the cadence alive without manual work each month.
Do simulations capture passwords? No — Cyber Aware's simulations have no credential harvesting. Reporting shows who clicked and who reported, which is everything a programme needs.
What happens when someone clicks a simulation? They land on a branded explainer showing the simulated email and its red flags, and they are auto-enrolled into the failed-phishing course the same day.
Can staff report suspicious emails instead of clicking? Yes — a report button in the portal plus Outlook and Gmail add-ins. Every report is logged and matched against the simulation schedule.
One last thing
If you already run training but no simulations, you have the lesson without the test — and no number to prove the lesson worked. One baseline campaign this month, clickers auto-coached, is the cheapest way to fix that.