A phishing simulation email is a safe, fake phishing email a security team sends to its own staff to test whether they click, reply or report - identical in design to a real attack, but landing in your inbox instead of a criminal's.
TL;DR
- A phishing simulation email replicates a real attack safely so you can measure click and report rates before a criminal does the same test.
- It is the same tooling attackers use; only the destination and intent differ.
- A campaign is judged by report rate and repeat behaviour, never by click rate alone.
- Never punish clickers; measure, train, re-test.
Why organisations run phishing simulations
Email is the front door for most breaches. Technical filters catch a share of malicious mail, but the messages that reach an inbox are defeated by one thing only: a person who recognises the warning signs. A simulation measures exactly that, in production conditions, without the breach.
The evidence is blunt. Industry programmes repeatedly find that after sustained simulation programmes, the share of staff clicking harmful links drops sharply while the share reporting them climbs. Phishing remains the most-reported cybercrime category in Australia, and organisations that never measure it are guessing at their exposure.
What a phishing simulation email looks like
A good simulation is indistinguishable from the real thing in every way but one - where the links lead. Common templates mirror what Australian staff actually receive:
- Package delivery notifications - the most clicked real-world lure, and the most used simulation.
- Fake Microsoft 365 or Google login pages - credential harvesting is the most common real attack goal.
- myGov, ATO and Medicare themed scams - personal-looking lures that test scepticism at work.
- Voice message notifications and document shares - file and voicemail lures rank among the most clicked categories year after year.
A click takes staff to a safe educational landing page that explains what just happened. Nothing is installed, nothing is reported to anyone outside the organisation, and no credentials are collected.
What the results tell you
Three numbers matter. Click rate shows exposure. Report rate shows whether people flag the mail before harm. Repeat-click rate shows who needs targeted help, which is why one-off campaigns produce charts rather than behaviour change.
The target improves over time. A first campaign is a baseline - industry benchmarks show initial click rates commonly fall between roughly a quarter and a third of recipients for realistic lures - and the useful signals after that are the trend and the tail. The goal is not zero clicks on the first test; it is a rising report rate and a shrinking repeat-click group campaign over campaign.
Running a campaign the right way
- Announce the programme, not the dates. Staff should know simulations exist; if the exact campaign dates are secret, the test measures luck, not behaviour.
- Start with realistic lures, not obvious ones. Overly fake templates flatter the numbers and teach nothing.
- Send the training immediately after a click. A click is a teachable moment with a short shelf life; the micro-lesson lands while the memory is fresh.
- Report aggregate results, never names. A named-shame list kills reporting culture in one email.
- Re-test monthly or quarterly. Behaviour change comes from cadence, not from one memorable email.
Never punish a click
The fastest way to ruin a phishing programme is to punish staff for failing one. The moment a click can cost someone, staff stop reporting suspicious email - including real ones - because reporting becomes self-incrimination. The phishing simulation programme works only when reporting is safe, celebrated and fast.
How Cyber Aware runs simulations
Cyber Aware automates the whole cycle: realistic templates drawn from live Australian scam patterns, scheduling that keeps campaigns fresh, instant micro-training on click, and reporting that shows click, report and repeat behaviour by team. Those feeds roll up into human risk reporting, so the numbers a board sees are the same numbers the security team works from.
FAQ
Is a phishing simulation email dangerous? No. Links lead to safe education pages, no credentials are collected, and no software is installed. It replicates the experience of an attack, not the consequences.
How often should we run phishing simulations? Monthly is the most common cadence for active programmes; quarterly is the minimum that produces measurable behaviour change.
Will staff know it is a simulation? A good one does not look simulated in the inbox. That is the point - you are measuring behaviour under realistic conditions.
What click rate should we expect? First campaigns commonly see roughly a quarter to a third of recipients click a realistic lure. The trend across campaigns matters more than the first number.
Is it legal to phish your own staff? In Australia, yes, when done transparently, with an announced programme, no deception about consequences, and no personal punishment. Privacy obligations around monitoring still apply.