Category: Security Awareness & Training

Phishing Simulation

Also known as: Simulated Phishing Attack, Attack Simulation Test, Phishing Simulation Test

Simply put

A phishing simulation is a controlled cybersecurity exercise in which an organization sends its own employees fabricated but realistic phishing emails to see whether they recognize and report the attempt. It is a safe test rather than a real attack, and its purpose is to measure and improve how well people respond to phishing. Results are typically used to guide follow-up training rather than to penalize individuals.

Formal definition

A phishing simulation is a security awareness exercise in which an organization delivers fabricated yet realistic phishing lures to its workforce to test their ability to recognize, avoid, and report social engineering attempts. Simulations are commonly delivered through dedicated platforms or built-in tooling that can model a spectrum of techniques (such as email-based lures) within a sandboxed or controlled environment, and typically capture metrics such as click rates and reporting rates. In many engagements, effective programs pair simulations with immediate feedback and defined KPIs so that outcomes inform targeted remediation. Note that a phishing simulation measures human response and awareness maturity; it does not by itself remediate technical email security controls, and its value depends on ethical lure design, organizational buy-in, and integration with broader training rather than punitive use. A virtual CISO may advise on the strategy, cadence, and governance of such a program but does not typically administer the simulation platform unless explicitly contracted.

Why it matters

Phishing remains one of the most common entry points for security incidents because it targets people rather than technology, and technical controls alone cannot fully prevent an employee from clicking a convincing lure. A phishing simulation gives an organization a way to measure how its workforce actually responds to social engineering under controlled conditions, rather than assuming that awareness training has produced the intended behavior. By capturing metrics such as click rates and reporting rates, the exercise turns human risk from an abstract concern into something observable and trackable over time.

The value of a simulation depends heavily on how it is run. Ethical lure design, immediate feedback, and defined KPIs help convert results into targeted improvement, whereas punitive use tends to erode trust and discourage the reporting behavior the program is meant to build. It is important to understand what a simulation does and does not do: it measures human response and awareness maturity, but it does not by itself remediate technical email security controls or guarantee that a real attack will be caught. Its usefulness is also tied to organizational buy-in and the maturity of the surrounding training program.

For security leaders, phishing simulations are a governance and risk-management instrument as much as a training tool. They provide evidence to support decisions about training cadence, remediation priorities, and reporting to executives or boards. A virtual CISO may advise on the strategy, cadence, and governance of such a program, but accountability for how results are used and for the broader security posture remains with the client organization and its officers.

Who it's relevant to

Security and IT Leaders

Leaders responsible for the security program use phishing simulations to measure workforce awareness maturity, identify where targeted remediation is needed, and track improvement over time. They should treat results as indicators of human risk to be managed rather than as grounds to penalize individuals, since punitive use tends to suppress the reporting behavior the program aims to encourage.

Executives and Organizational Officers

Executives benefit from the metrics a simulation produces, such as click and reporting rates, when making decisions about training investment and understanding human-related risk. They should recognize that accountability for security decisions and outcomes remains with the organization and its officers, and that a simulation measures awareness but does not by itself guarantee protection against real attacks.

Employees and General Workforce

The workforce is the direct subject of a phishing simulation, since the exercise tests their ability to recognize, avoid, and report phishing attempts. When simulations use ethical lure design and provide immediate feedback, employees gain practical experience that reinforces awareness training, provided the program is positioned as learning rather than as a test they can fail.

Virtual and Fractional CISOs

A virtual or fractional CISO may advise on the strategy, cadence, KPIs, and governance of a phishing simulation program as part of broader security awareness and risk management. They typically do not administer the simulation platform or perform hands-on operational delivery unless explicitly contracted, and the value of their guidance depends on organizational buy-in, defined scope, and access to relevant stakeholders.

Inside Phishing Simulation

Simulated Phishing Campaign

A controlled exercise in which benign, phishing-style messages are sent to employees to measure how they respond to realistic social engineering attempts, without exposing the organization to actual harm.

Metrics and Reporting

Data captured during the exercise, such as click rates, credential submission rates, and reporting rates, used to assess susceptibility and track trends over time. Metrics are indicators of behavior rather than guarantees of future resistance.

Targeting and Segmentation

The selection of recipient groups, which may vary by department, role, or risk exposure, allowing an organization to tailor difficulty and focus on higher-risk populations.

Follow-up Training and Remediation

Educational content or coaching delivered to users who fall for a simulation, intended to reinforce awareness. Effectiveness typically depends on how the training is designed and whether it is reinforced over time.

Governance and Program Alignment

The placement of phishing simulation within a broader security awareness and human-risk program. A virtual CISO often advises on strategy, cadence, and success criteria, while the operational running of campaigns may be handled by internal staff or a specialized vendor.

Scope and Consent Considerations

Defined boundaries covering who is included, how results are used, and how employee data and privacy are handled, which may vary by provider and by applicable organizational policy or regulation.

Common questions

Answers to the questions practitioners most commonly ask about Phishing Simulation.

Does running a phishing simulation mean a virtual CISO is managing our security operations?

No. Designing or overseeing a phishing simulation is a governance and program-development activity, not an operational security function. A virtual CISO typically advises on awareness strategy, helps define objectives, and interprets results to guide risk decisions, but they generally do not perform hands-on operational tasks such as monitoring, tool administration, or ongoing campaign execution unless that work is explicitly contracted. Conflating this advisory role with a managed security service provider or an internal security operations team is a common mistake.

Will a phishing simulation prevent our organization from being breached?

Not on its own. A phishing simulation measures susceptibility and reinforces awareness, but it does not guarantee breach prevention. It is one component of a broader security program, and its value depends on organizational maturity, follow-up training, and how results feed into risk management. A virtual CISO can help frame simulations as a diagnostic and educational tool rather than a control that eliminates human-related risk. Accountability for acting on the findings typically remains with the client organization and its officers.

How does a virtual CISO typically decide what a phishing simulation should measure?

In many engagements, a virtual CISO works with stakeholders to define objectives before launching a simulation, such as measuring click rates, credential-entry rates, or reporting behavior. The specific metrics often vary by provider and by the organization's maturity. The virtual CISO generally advises on scope and success criteria, while execution and reporting details depend on the tools and internal teams involved, which are typically defined in the engagement contract.

Who is responsible for running the simulation and handling employees who fail?

Responsibility for executing the campaign and administering follow-up often sits with internal teams or a contracted delivery function, not automatically with the virtual CISO. A virtual CISO typically advises on process, recommends non-punitive remediation approaches such as targeted training, and helps interpret outcomes. Accountability for personnel decisions and program actions usually remains with the client organization. It is worth clarifying these boundaries in the engagement scope.

How often should phishing simulations be conducted?

Cadence varies by organization and provider, and there is no single universal standard. In many programs, simulations are run on a recurring basis so that results can be tracked over time and awareness reinforced, rather than as a one-time exercise. A virtual CISO can help align frequency with the organization's risk profile, maturity, and any relevant framework expectations, while recognizing that the appropriate schedule depends on client context and resources.

How do phishing simulation results connect to broader compliance or framework efforts?

Simulation results can support security awareness objectives referenced in frameworks and standards such as NIST CSF or ISO 27001, but a simulation alone does not assert certification or guarantee compliance. A virtual CISO can help map awareness activities to relevant control expectations and support readiness, while being clear that supporting readiness is distinct from claiming certification. The depth of this alignment depends on client cooperation and access to the relevant stakeholders and evidence.

Common misconceptions

A phishing simulation program means a virtual CISO is running the organization's security operations.

A virtual CISO typically advises on and governs the awareness strategy, cadence, and metrics rather than performing hands-on campaign execution, tool administration, or ongoing operational monitoring, which are generally out of scope unless explicitly contracted. Campaign delivery is often handled by internal teams or a separate vendor.

Running phishing simulations prevents breaches or guarantees employees will not fall for real attacks.

Simulations measure and help reduce susceptibility but cannot guarantee breach prevention. Results reflect behavior at a point in time, and value depends on organizational maturity, follow-up training quality, and sustained reinforcement.

Good simulation results demonstrate compliance or certification against a framework such as SOC 2, ISO 27001, or HIPAA.

Simulations may support readiness by evidencing security awareness activity, but they do not by themselves assert certification or full compliance. Accountability for compliance decisions typically remains with the client organization and its officers.

Best practices

Define clear scope, objectives, and success criteria before launching, including which groups are targeted and how results and employee data will be used.

Pair every simulation with timely, constructive follow-up training rather than using results punitively, so the exercise reinforces behavior instead of eroding trust.

Track meaningful metrics over time, such as reporting rates and repeat susceptibility, rather than treating a single click rate as a definitive measure of risk.

Position phishing simulation within a broader human-risk and governance program, and clarify that the virtual CISO advises on strategy while the client retains accountability for security decisions.

Vary difficulty and scenarios across campaigns and segment by role or risk exposure to avoid predictable patterns and to focus effort on higher-risk populations.

Confirm stakeholder access, executive support, and internal cooperation, since the value of the program depends on organizational maturity and consistent participation.