How to Build a Phishing Simulation Program That Actually Changes Behavior
Phishing simulations are the most widely deployed security awareness tool in enterprise security programs — and one of the most poorly executed. The common failure mode: send a generic template, measure who clicked, shame or report them, repeat quarterly. Employees learn to spot simulation templates, not actual phishing. Behavior in real phishing scenarios does not improve.
Effective phishing simulation programs treat click events as teaching opportunities, use template diversity that reflects the actual threat landscape, and track susceptibility trends at the individual and cohort level over time. This guide covers the design, execution, and measurement methodology that distinguishes programs that move the needle from those that generate compliance reports.
Program Design: Frequency, Template Mix, and Targeting Strategy
The most important design decision is simulation frequency. Quarterly campaigns produce quarterly alertness — employees become cautious in the weeks following a simulation and complacent the rest of the year. Monthly simulations with randomized send timing produce more consistent vigilance. For highest-risk groups (finance, HR, executives, IT admins), bi-weekly simulations are defensible given their attack surface exposure.
Template diversity is the second critical design variable. A program that repeatedly uses the same template style (IT helpdesk password resets, fake shipping notifications) trains employees to recognize that specific template, not the phishing technique. A mature template library rotates across: credential harvesting pages (fake login portals), vishing-adjacent pretexts (voicemail notifications with malicious links), business email compromise scenarios (urgent wire transfer, CEO impersonation), vendor impersonation (DocuSign, Adobe Sign, Microsoft Teams), and topical lures tied to current events.
Target your highest-risk users for your most sophisticated templates. Finance team members who approve payments should receive BEC scenarios. IT admins should receive help desk and vendor impersonation attacks. Executives should receive board meeting invitation and investor communication lures. Generic templates for all users is appropriate for baseline measurement; differentiated targeting produces more useful risk data.
Immediate Teachable Moments vs. Delayed Feedback
The timing of feedback after a click event determines whether a simulation changes behavior. Research on behavior modification consistently shows that feedback delivered within seconds of an action is more effective than feedback delivered hours or days later via a training module assignment.
The most effective implementation: when an employee clicks a simulated phishing link, they immediately land on a branded page that reveals it was a simulation, explains what the phishing indicator was (urgency language, suspicious sender domain, mismatched URL), and delivers a 90-second targeted micro-lesson specific to that template type. This is fundamentally different from assigning a 20-minute annual training course as a consequence of clicking.
For employees who click repeatedly across multiple campaigns, escalate the response: first click triggers an immediate micro-lesson; second click in 90 days triggers a mandatory 15-minute targeted module; third click triggers a manager conversation and formal training enrollment. This graduated response applies pressure proportionate to demonstrated risk without treating all clickers as equally negligent.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Measuring What Actually Matters: Behavior Change Over Time
Click rate is a lagging indicator of program effectiveness and a poor one in isolation. A 15% organizational click rate in month one that drops to 3% by month twelve represents substantial behavior change. A steady 5% rate with no trend tells you almost nothing.
The metrics that actually matter for program evaluation: repeat clicker rate (the percentage of employees who click in multiple campaigns within a rolling 90-day window — these are your highest-risk individuals), time-to-report rate (the percentage of simulated phishing emails that employees report to the security team rather than just ignoring or clicking — this measures proactive participation, not just click avoidance), susceptibility index by department and role (which business units are consistently above baseline — this drives targeted training investment), and behavioral trend over 12 months (is aggregate susceptibility improving, plateauing, or worsening?).
For reporting to leadership and the board, frame results in risk language rather than training language. A 23% reduction in click rate across the organization represents a measurable reduction in successful phishing preconditions. Correlate simulation data with actual security events: organizations with lower simulation click rates do experience fewer successful credential theft incidents.
Platform Selection and Integration Requirements
The three dominant phishing simulation platforms are KnowBe4, Proofpoint Security Awareness Training, and Cofense. Each has different strengths that make them appropriate for different organizational contexts.
KnowBe4 has the largest template library (over 50,000 simulated phishing templates) and the most mature automated campaign workflows. Its PhishER module integrates with your email environment to triage actual reported phishing alongside simulated phishing, routing real threats to your SOC. Best for organizations that prioritize simulation volume and template diversity.
Proofpoint Security Awareness Training integrates directly with Proofpoint's email security platform, allowing simulation targeting based on actual threat intelligence — who in your organization was targeted by real phishing in the past 30 days gets a simulation using a similar template. Best for organizations already on Proofpoint's email security stack.
Cofense focuses on the reporting side — its PhishMe platform is specifically designed to drive report-button behavior rather than just measuring clicks. Best for organizations where training the SOC's phishing triage pipeline (real reports from employees) is the primary goal alongside awareness.
Integration requirements regardless of platform: whitelist simulation sending IPs in your email security gateway (otherwise your gateway quarantines simulations before delivery), integrate the report-phishing button with your SIEM or ticketing system, and configure SCIM provisioning from your IdP so new employees are automatically enrolled.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, remediation steps, and every daily briefing.
The bottom line
A phishing simulation program that sends the same four templates quarterly and measures click rates is a compliance activity, not a security control. Effective programs use monthly simulations with role-differentiated templates, deliver immediate feedback at the click event, track repeat clickers as individuals, and measure behavioral trend over a 12-month period. The goal is reducing susceptibility in real phishing scenarios — not improving simulation click rates.
Frequently asked questions
What is a good phishing simulation click rate?
Industry benchmarks from KnowBe4 and Proofpoint show that organizations with no prior simulation training average a 30-35% click rate on their first campaign. After 12 months of monthly simulations, the median drops to 2-5%. A rate below 5% after sustained training is considered mature. However, click rate alone is insufficient — measure the repeat clicker rate (the same individuals clicking across multiple campaigns) and the report rate (employees actively reporting simulations) alongside the aggregate click rate.
Is it legal to phishing-test your own employees?
Yes, in virtually all jurisdictions, organizations have the right to conduct security testing of their own systems and employees using their corporate infrastructure. However, specific scenarios can create legal or HR complications: simulations that impersonate specific real executives by name (rather than generic 'CEO' pretexts), scenarios involving personal health information or religious topics, and simulations timed around sensitive organizational events. Coordinate with HR and legal before deploying novel or potentially sensitive scenarios. Disclose the existence of a simulation program (but not the timing) in acceptable use policies.
How do you prevent employees from sharing phishing simulation alerts?
You cannot fully prevent employees from warning each other, and attempting to do so creates a culture of distrust that undermines the security awareness goals. A better framing: reward the employee who reports a simulation to the security team, even if they also warned colleagues. The desired behavior is report-to-security, and reporting behavior is more important than naive click avoidance. Some organizations run simulations on a rolling basis (one campaign starting as another completes) so there is no single 'simulation week' that employees learn to identify.
What is the difference between phishing simulation and phishing resistance training?
Phishing simulation measures susceptibility and provides reactive feedback when employees fail. Phishing resistance training is proactive — it teaches employees to identify specific phishing indicators (urgency language, domain mismatch, unexpected attachment types) before they encounter a real phishing email. Effective programs combine both: proactive training modules that teach indicator recognition, followed by simulations that test whether the training transferred to actual behavior. Neither alone is sufficient.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.
The Mythos Brief is free.
AI that finds 27-year-old zero-days. What it means for your security program.