How do we run phishing simulations that teach rather than punish?

Start

You want practice emails that build the habit of reporting

A practice email exists to build one habit: reporting a suspicious email at once. It is judged on reporting, never on catching people out. Run badly, a programme teaches people to distrust the security team, damages trust in real messages, and can breach employment and data protection law.

• Then: Is the programme signed off by all four approvers, and in date?

Decision

Is the programme signed off by all four approvers, and in date?

The Head of Information Security, HR, the Data Protection Officer and Legal sign the programme before the first practice email. By the pack's default it is renewed every 12 months, and whenever the method changes: a new grade, a new kind of simulation, new fields recorded or a new platform. While any item fails, no practice email runs.

• Yes: Set the grade the progression rule gives the group
• No, lapsed, or not known: Get the sign-offs, staff representatives first where required

Step

Get the sign-offs, staff representatives first where required

Legal confirms the national rules on monitoring at work and whether staff representatives must be informed, consulted or agree; where they must, that comes first. The Data Protection Officer records the lawful basis; a public authority uses the basis its law gives it, not legitimate interests. Set the platform to keep only four facts and to show managers groups only. Tell staff what is recorded, who sees it and how support works, without saying when. No practice email is sent until every item passes.

• Then: Set the grade the progression rule gives the group

Step

Set the grade the progression rule gives the group

Grades run from 1 (five or more cues) to 4 (one cue, tailored to a role), set by counting the lure's cues. Everyone starts at Grade 1. A grading group moves up one grade when its last two campaigns at the current grade, taken together, reached at least 20% reporting and at most 15% clicks, the pack's defaults. It never moves down as a penalty; if clicks double at a new grade, the next campaign goes back one.

• Then: Is it a Grade 4 campaign, tailored to one role?

Decision

Is it a Grade 4 campaign, tailored to one role?

The progression rule stops at Grade 3. Grade 4 is used only for a role at higher risk graded on its own, such as payment staff or privileged users, and each campaign is a decision of its own.

• Yes: Head of Information Security approves it in writing
• No: Write the lure on the month's theme, and count its cues

Step

Head of Information Security approves it in writing

Approval is campaign by campaign, in writing, before the send. Without it the campaign is not cleared to send.

• Then: Write the lure on the month's theme, and count its cues

Step

Write the lure on the month's theme, and count its cues

The lure follows the month's theme where it can, so that the teaching page repeats what the month taught. The lure brief gives the story in one line, each cue, the send group and the teaching page. Use fictional names and look-alike organisations.

• Then: Does the lure touch a forbidden topic, or name anyone real?

Decision

Does the lure touch a forbidden topic, or name anyone real?

HR checks every lure before it is used. Never use pay, bonuses, benefits or gifts; health; redundancy, restructuring, reviews or discipline; real emergencies, disasters or appeals; the reporting route or the security team's own warnings; or a real colleague, supplier, customer or partner. No exception can set these aside. Where the awareness lead and HR disagree about a lure, it is not used.

• Yes, or HR and the lead disagree: Replace the lure; never adjust it until it passes
• No: Build the send list, leaving out those who must not receive it

Step

Replace the lure; never adjust it until it passes

A rejected lure is replaced with a new one, never argued through or edited until it scrapes past. The check is on the topic, not on whether the lure would work: a bonus statement would be effective, which is why it is forbidden.

• Then: Write the lure on the month's theme, and count its cues (back to an earlier step)

Step

Build the send list, leaving out those who must not receive it

Leave out joiners in their first 30 days, people on a long absence, anyone sent a practice email in the last 30 days, and anyone HR has asked to leave out for personal circumstances, without recording the reason with the results. Avoid payroll day, the busiest trading days and any period of redundancy consultation.

• Then: Is a Severity 1 or 2 incident open on the day before or of sending?

Decision

Is a Severity 1 or 2 incident open on the day before or of sending?

A real attack needs everyone's attention, and the reporting route needs to be free. Check the incident log on the day before sending and again on the day. If you cannot tell, hold.

• Yes, or not known: Hold the send until the incident closes
• No: Brief the service desk, and ready the teaching page

Outcome

Hold the send until the incident closes

Send once the incident has closed and the other checks still pass. In the pack's example, one send went out 2 working days after a Severity 1 incident closed.

• Then: Is a Severity 1 or 2 incident open on the day before or of sending? (back to an earlier step)

Step

Brief the service desk, and ready the teaching page

The service desk and the incident manager know the campaign is running, so a report is thanked and not escalated. The teaching page is ready for this lure; test it on a phone and on a floor terminal. The sending route passes mail filtering for this campaign only, and the domain cannot receive replies.

• Then: Send across the day; keep it open for 5 working days

Step

Send across the day; keep it open for 5 working days

Spread the send over the working day, so that one report does not warn the whole group at once. A click shows the teaching page at once: this was a practice email, nobody else will see that you clicked, the cues you could have spotted, and how to report next time. No score, no test and no warning. A report after a click counts as a report.

• Then: Close: count reporting first, and publish no results

Step

Close: count reporting first, and publish no results

Count the reporting rate and time to first report for each group, with its grade; clicks and credentials entered are context. Send the group a note within 3 working days with the cues and a thank-you, and no figure. Line managers see their team's result only where the team has at least 10 people. Results are never published, ranked or announced.

• Then: Has anyone now clicked twice within 12 months?

Decision

Has anyone now clicked twice within 12 months?

The awareness lead counts from the platform's own results, which only the lead sees by name. A second click within 12 months starts the support stages. It never starts a sanction.

• Yes: Offer private coaching within 10 working days of closing
• No: Next month: the other send group, under the same checks

Step

Offer private coaching within 10 working days of closing

The awareness lead offers a short private session about the person's own inbox; taking it up is voluntary. A third click brings a support conversation and stronger protection for the account.

• Then: Next month: the other send group, under the same checks

Outcome

Next month: the other send group, under the same checks

Two send groups take turns, so each person receives one practice email about every two months. Compare results only at the same grade, report group figures monthly, and reduce named results to group figures after 12 months, on the platform and in any export.