Phishing Simulation Programme Method
Sets difficulty grading, frequency, measurement and follow-up so simulations teach rather than punish.
Available soon
- Format
- Word
- Size
- 72 KB
- Length
- 25 pages
- Version
- 1.0
- Updated
What's inside
- Purpose
- The rules
- Principles
- Inputs
- Scales and criteria
- Decision logic
- How often, and who is left out
- Writing and checking a lure
- The teaching page
- Measuring a campaign
- Support for repeat clickers
- Approval and ethics
- Data protection
- Worked examples
- Questions to be ready for
- Limitations
- Calibration and review
- Related documents
- Adapting this template
- Framework references
- Definitions
What changed
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
This method is how [[Organisation Name]] uses practice phishing emails to build one habit: reporting a suspicious email at once. It sets how hard each email is, how often people receive one and who is left out, what is recorded and who sees it, what happens after a click, and how people who keep clicking are supported. Every simulation is approved before it starts, and is judged on reporting, not on catching people out.
It sets the method behind the pack's simulation rules (AW-08, AW-09, AW-10, AW-11, AW-12, AW-13, AW-14 and AW-15). The Phishing Simulation Ethics & Approval Checklist applies it before the programme starts and before every campaign; the Human Risk Metrics Dashboard reports its measures; the Annual Security Awareness Plan sets the theme each campaign follows.
Guidance — delete before approval
A simulation programme run badly does harm: it teaches people to distrust the security team, damages trust in real messages, and can breach employment and data protection law. Run it only with the approvals of section "Approval and ethics" in place.
Replace every value in [[double brackets]] before approval, and name roles, not people.
The rules
These rules, from the Security Awareness Programme pack, govern every practice email. The sections that follow explain how each is applied.
AW-08 Every awareness activity must end with the one reporting route (P09 IM-01). Every report is thanked and, where the person asks, told what happened next. Nobody is blamed for a report made in good faith, including a report made after clicking, which counts as the right behaviour.
AW-09 No simulation may run until the programme has been approved on the ethics and approval checklist by the Head of Information Security, HR, the Data Protection Officer and Legal, and cleared with the works council or staff representatives where national law or a collective agreement requires it. The approval is renewed every [[12]] months and whenever the method changes.
AW-10 A simulation must never use a lure about pay, bonuses, benefits or gifts from the organisation; health or medical matters; redundancy, restructuring or disciplinary action; or a real emergency, disaster or appeal. It must never imitate the reporting route, the security team's own warnings, a real named colleague, or a real supplier or customer.
AW-11 Each simulation carries a difficulty grade from 1 to 4, set by the cues it leaves. Each person receives one simulation every [[2]] months, never two within [[30]] days, and none while a Severity 1 or 2 incident is open or while they are on a long absence (P13 JML-11). A grading group is sent its simulations in [[2]] send groups, one a month in turn, and moves up a grade only when its last [[2]] campaigns at the current grade, one for each send group and taken together, reach the progression thresholds. Grade 4 is used only for roles at higher risk, with the Head of Information Security's approval of each campaign.
AW-12 A click on a simulation must lead at once to a teaching page that shows the cues the person missed and how to report next time. Results are never published, ranked or announced, and no simulation is sent as a penalty.
AW-13 Individual results are personal data. Only the minimum is recorded: sent, clicked, entered a credential, reported, and when. Never what was typed, and never whether an email was opened. Results by name go only to the person and to the awareness lead; everyone else sees group results of at least [[10]] people. Named results are kept for [[12]] months, then reduced to group figures. The lawful basis, and the legitimate interests assessment where that is the basis, are recorded with the Data Protection Officer before the first campaign, and staff are told in advance what is recorded and who sees it.
AW-14 Support for a repeat clicker comes before any sanction, in the stages the simulation method sets: a second click within [[12]] months brings an offer of private coaching within [[10]] working days, and a third brings a support conversation and extra technical protection for the person's account. A simulation result is never on its own a ground for disciplinary action. A sanction is for the disciplinary process alone, and only where a person, after support, deliberately disregards a rule in real work.
AW-15 The programme must be judged on behaviour: the human risk measures HRM-01 to HRM-05, with training completion (P11 MC-36) and phishing compromises (P11 MC-34) beside them, each with its target and status in words (P11 MR-12). Where another pack defines a measure, its definition and target are used unchanged (P11 MR-04). Simulation figures are compared only at the same grade: a change of grade is a break in series (P11 MR-09).
AW-18 Any departure from these rules is a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent. AW-10, AW-12, AW-13 and AW-14 admit no exception.
Guidance — delete before approval
The rules are the pack's, set in its guide; change them there, and here to match. AW-10, AW-12, AW-13 and AW-14 protect the people simulated, and no exception can set them aside, whatever the business case.
Principles
Most questions about why the method works as it does are answered by one of these.
- Reporting is the point. A simulation exists to build the habit of reporting. A falling click rate with no reporting is not success. (AW-15)
- Teach, never catch. A click leads to a teaching page and nothing else. Nobody is named, ranked or warned. (AW-12)
- Fair difficulty. The grade rises only when a group is ready for it, and results are compared only at the same grade. (AW-11)
- Never at people's expense. Some lures are never used, whatever an attacker might do, because they damage trust in messages people must believe. (AW-10)
- The minimum about people. Only four facts are recorded, names are seen by one person, and named results are reduced to group figures after a year. (AW-13)
- Support before sanction. Someone who keeps clicking needs help, a better-protected account, or a lighter inbox. A simulation result is never on its own a ground for discipline. (AW-14)
- Agreed before it starts. HR, Legal, the Data Protection Officer and, where the law requires, staff representatives approve the programme before the first email. (AW-09)
- The control comes first. A simulation never stands in for a technical control that would stop the harm. (AW-02)
Inputs
The awareness lead gathers these before the first campaign, and again before each one.
Input | Where it comes from | When |
|---|---|---|
The people in scope, with their role group and send group | HR record, through the joiner, mover and leaver process (P13) | Each campaign, extracted on the day of the exclusion check |
Joiners in their first days, and people on a long absence | HR record (P13 JML-07, JML-11) | Each campaign |
Open Severity 1 and 2 incidents | The incident case log (P09) | Each campaign, on the day before sending and on the day of sending |
The month's theme | The annual plan | Each campaign |
Each group's last results at its current grade | The simulation platform's group report | Each campaign, to set the grade |
The signed ethics and approval checklist | The ethics and approval checklist | Before the first campaign, then every [[12]] months |
The reporting route, and how reports reach the platform | The incident manager (P09) | Before the first campaign |
Busy periods to avoid: payroll day, peak trading, redundancy consultation | HR and the business owners | Each quarter |
Scales and criteria
Difficulty grades
Each simulation carries a difficulty grade from 1 to 4, set by the cues it leaves. The fewer cues a lure leaves, the harder it is to spot.
Grade | Cues left | What it looks like | Used for |
|---|---|---|---|
Grade 1: obvious | Five or more | A generic sender, a generic greeting, spelling errors, a link whose address does not match its text, and an urgent demand. | Everyone, at the start of the programme |
Grade 2: plausible | Three or four | A common service such as a parcel company or a shared document, with a believable message and a lookalike link. | Everyone, once Grade 1 is passed |
Grade 3: targeted | One or two | Looks internal or from a known kind of supplier, relevant to the person's work, with one subtle cue such as a lookalike domain. | Groups that have passed Grade 2 |
Grade 4: tailored | One | Written for one role from information anyone can find, as a real attacker targeting that role would. | Roles at higher risk only, each campaign approved by the Head of Information Security |
A cue is a sign that a message is not genuine. Count these on every lure brief; their number sets the grade.
- A sender the person does not deal with, or a generic one
- A generic greeting in place of the person's name
- Spelling or grammar errors
- A link whose address does not match its text or its sender
- A sender or link domain that imitates a real one
- Urgency, a threat or a deadline
- A request for a password, a code or a payment
- Something the person did not expect or ask for
What is measured
In order of importance (AW-15). The first two are the pack's human risk measures; the last two are shown beside them for context.
Measure | Why |
|---|---|
Reporting rate | The behaviour the programme exists to build: a reported attack can be stopped for everyone. |
Time to first report | How soon a real attack would be known. |
Click rate | Context only: it moves with the grade and the lure, and a falling click rate with no reporting is not success. |
Credentials entered | The worst outcome of a click: the share of clicks that would have given an account away. |
Measure | Definition | Target |
|---|---|---|
HRM-01 Simulation reporting rate | People who reported the month's simulation through the reporting route within the campaign window, out of the people it was sent to, shown with its grade. | [[40%]] at the group's current grade |
HRM-02 Time to first report | Minutes from the month's simulation being sent to the first report of it through the reporting route, shown with its grade. | [[10]] minutes or less at the group's current grade |
HRM-03 Repeat clickers | People who clicked in two or more simulations in the last 12 months, out of the people sent two or more in that time. A group figure; never a list of names (AW-13). | [[2%]] or fewer |
What is recorded
Individual results are personal data. Only the minimum is recorded: sent, clicked, entered a credential, reported, and when.
Recorded for each email sent | Never recorded |
|---|---|
• Sent: when • Clicked: whether and when • Entered a credential: whether and when, never what • Reported: whether and when, through the reporting route | • What was typed into the sign-in page • Whether the email was opened (opening counts are unreliable and say nothing about behaviour) • Location, device or browser details beyond what the platform needs to deliver the page |
Decision logic
The steps of a campaign
Days are working days from the send day (day 0). The campaign stays open for [[5]] working days.
Step | When | Who | How | Rule |
|---|---|---|---|---|
Choose the lure and the grade | Day [[-10]] | Awareness lead | On the month's theme. The grade is the one the progression rule gives the group. Write the lure brief. | AW-11 |
Check the lure | Day [[-5]] | HR | Against the forbidden lures, and for any real name. A rejected lure is replaced, never argued through. | AW-10 |
Approve a Grade 4 campaign | Day [[-5]] | Head of Information Security | Grade 4 only, for roles at higher risk, approved in writing campaign by campaign. | AW-11 |
Build the send list | Day [[-1]] | Awareness lead | Leave out joiners in their first [[30]] days, people on a long absence, anyone simulated in the last [[30]] days, and anyone HR has asked to leave out. | AW-05, AW-11 |
Check for open incidents | Day [[-1]] and day 0 | Awareness lead | No send while a Severity 1 or 2 incident is open. Hold the campaign until it closes. | AW-11 |
Tell the people who receive reports | Day [[-1]] | Awareness lead | The service desk and the incident manager know the campaign is running, so a report is thanked and not escalated. | AW-08 |
Send | Day 0 | Awareness lead | Spread over [[the working day]], so that one report does not warn the whole group at once. | AW-11 |
Keep the campaign open | Days 0 to 5 | The platform | Reports and clicks are counted. Every click shows the teaching page at once. | AW-12 |
Close and count | Day 5 | Awareness lead | Reporting rate, time to first report, click rate and credentials entered, for each group, with its grade. | AW-15 |
Offer support | Within [[10]] working days of closing | Awareness lead | Stage 2 coaching to every second click within the year; stage 3 support to every third. | AW-14 |
Report the measures | Monthly | Head of Information Security | Group results only, monthly to the security and IT leadership team, and to executive management in the metrics programme's monthly executive report (P11). | AW-16 |
Reduce named results | After [[12]] months | Awareness lead | Named results are deleted or reduced to group figures, on the platform and in any export. | AW-13 |
How often, and who is left out
Each person receives one simulation every [[2]] months, never two within [[30]] days, and none while a Severity 1 or 2 incident is open or while they are on a long absence (P13 JML-11).
- Two send groups. Everyone in scope is split at random into two send groups, Group A and Group B, and each month one of them receives the practice email. Each person therefore receives one every [[2]] months, never two within [[30]] days. Keep a person in the same send group for the year, so that their results build a series.
- Joiners. No practice email in a joiner's first [[30]] days (AW-05). They receive the day-one essentials and the induction first (New Joiner Security Induction Deck).
- Long absence. Nobody on a long absence, more than [[30]] days, whose accounts are suspended (P13 JML-11).
- Open incidents. No send while a Severity 1 or 2 incident is open (P09). A real attack needs everyone's attention, and the reporting route needs to be free.
- Personal circumstances. HR may leave a person out at their manager's request, for bereavement, serious illness or similar. The reason is not recorded with the results.
- Bad timing. Avoid payroll day, the busiest trading days and any period of redundancy consultation (ET-12).
Grading by group
A grading group is the people whose results set a grade together: everyone in the baseline course, unless a role at higher risk is graded on its own. A role graded on its own is one of the roles at higher risk of the Role-Based Security Training Matrix (privileged users, finance and payment authority, developers and the others). The two send groups are parts of one grading group, so their campaigns at the same grade are taken together, one from each. A send group is never graded on its own. A role graded on its own can reach Grade 4, with the Head of Information Security's approval of each campaign.
Moving between grades
A grading group moves up one grade when its last [[2]] campaigns at the current grade, one for each of its send groups and taken together, had a reporting rate of at least [[20%]] and a click rate of at most [[15%]]. It never moves down as a penalty; a grading group whose click rate doubles at a new grade goes back one grade for its next campaign.
Test | Threshold | Taken over |
|---|---|---|
Reporting rate | At least [[20%]] | The grading group's last [[2]] campaigns at the current grade, one for each send group, taken together |
Click rate | At most [[15%]] | The same campaigns |
Step back | The click rate at a new grade is double the rate at the grade before | The first campaign at the new grade: the next campaign goes back one grade |
- Both thresholds must be met. A group that reports well but still clicks a lot stays where it is.
- The rule moves a group up to Grade 3 at most. Grade 4 is never reached by the rule: each Grade 4 campaign is a decision, for a role at higher risk.
- A group never moves down as a penalty. Stepping back after a doubled click rate corrects a grade that was too hard too soon.
- A change of grade is a break in series: results either side of it are not compared (AW-15, P11 MR-09).
Writing and checking a lure
Every campaign has a lure brief, written by the awareness lead and kept with the campaign record. The lure follows the month's theme in the Annual Security Awareness Plan where it can: a theme on fake sign-in pages runs with a sign-in lure, so the teaching page repeats what the month taught.
Field | What goes in it |
|---|---|
Campaign | ID, month and theme |
Send group | Who receives it, and how many after the exclusions |
Grade | The grade the progression rule gives the group (AW-11) |
The lure | The story the email tells, in one line |
Cues left | Each cue, listed; their number sets the grade |
Forbidden lures | Checked by HR against FL-1 to FL-6; no real name (AW-10) |
Teaching page | Ready for this lure, with the cues marked (AW-12) |
Sending route | Allowed through mail filtering for this campaign only; the domain cannot receive replies |
Approvals | HR's check of the lure; the Head of Information Security's approval for Grade 4 |
Lures that are never used
A simulation must never use a lure about pay, bonuses, benefits or gifts from the organisation; health or medical matters; redundancy, restructuring or disciplinary action; or a real emergency, disaster or appeal. It must never imitate the reporting route, the security team's own warnings, a real named colleague, or a real supplier or customer. None admits an exception (AW-18).
Ref | Never use | Why |
|---|---|---|
FL-1 | Pay, bonuses, benefits, pensions, or gifts and vouchers from the organisation | It plays on what people are owed, damages trust in real pay messages, and has caused public backlash where it was used. |
FL-2 | Health, medical results, illness or pandemics | It plays on fear for oneself or one's family. |
FL-3 | Redundancy, restructuring, performance reviews or disciplinary action | It plays on fear for one's job, and can be mistaken for the real thing. |
FL-4 | Real emergencies, disasters, threats to safety, bereavement or charity appeals | It exploits real suffering and trains people to distrust genuine emergency messages. |
FL-5 | The reporting route, or the security team's own warnings | It teaches people to distrust the one channel the programme needs them to trust. |
FL-6 | A real named colleague, or a real supplier, customer or partner | It can harm the person or the relationship named; use fictional names and look-alike, not real, organisations. |
Guidance — delete before approval
Real attackers use all of these. The programme does not, because its purpose is to build trust in reporting, and these lures destroy it. A lure that would make a person afraid, ashamed or angry if it were real teaches the wrong lesson.
Use fictional names and look-alike organisations. A lure that names a real supplier can reach that supplier's staff, and harm the relationship.
The teaching page
A click on a simulation must lead at once to a teaching page that shows the cues the person missed and how to report next time. It shows, in this order:
- This was a practice email from [[the security team]]. Nobody else will see that you clicked.
- The cues you could have spotted, marked on a picture of the email.
- How to report one next time, with the reporting route.
- One link to the module for this kind of email. No score, no test and no warning.
Write it in the same voice as the month's campaign. Show a picture of the email with the cues marked. Keep it to one screen. A person who entered a password sees one more line: change it now, through the usual route, and report it, because a real page would have taken it.
Guidance — delete before approval
Test the teaching page on a phone and on a floor terminal before the first campaign. A page that does not load teaches nothing.
Measuring a campaign
The programme must be judged on behaviour: the human risk measures HRM-01 to HRM-05, with training completion (P11 MC-36) and phishing compromises (P11 MC-34) beside them, each with its target and status in words (P11 MR-12). Where another pack defines a measure, its definition and target are used unchanged (P11 MR-04). Simulation figures are compared only at the same grade: a change of grade is a break in series (P11 MR-09).
- Reporting rate (HRM-01) is worked out for each campaign: reports through the reporting route within the [[5]]-working-day window, out of the people it was sent to. A report after a click counts as a report.
- Time to first report (HRM-02) runs from the first email sent to the first report received.
- Repeat clickers (HRM-03) is a share of the people sent two or more practice emails in the last [[12]] months, never a list of names.
- Click rate and credentials entered are shown beside the reporting rate, never instead of it. Credentials entered is also shown as a share of clicks: it is how many clicks would have given an account away.
- Real reports. The incident manager counts the suspicious emails staff report each month, and how many were real. A habit built on practice emails should show in real mail.
Comparing results
- Compare only campaigns at the same grade. When a group moves grade, mark the break and say "not comparable" in place of a direction (P11 MR-09).
- Show every measure with its target and its status in words (P11 MR-12). Statuses use P11's words: on target, below target within tolerance, outside tolerance.
- Group results go only to groups of at least [[10]] people (AW-13).
- Every measure goes monthly to the security and IT leadership team; executive management sees the measures short of target or outside green, with the plan's progress, in the monthly executive report of the metrics programme (P11); the board sees training completion through P03 BM-08 (AW-16).
Support for repeat clickers
Support for a repeat clicker comes before any sanction, in the stages the simulation method sets: a second click within [[12]] months brings an offer of private coaching within [[10]] working days, and a third brings a support conversation and extra technical protection for the person's account. A simulation result is never on its own a ground for disciplinary action. A sanction is for the disciplinary process alone, and only where a person, after support, deliberately disregards a rule in real work.
Stage | When | Who | What happens | What is recorded |
|---|---|---|---|---|
1 | Every click | The person alone | The teaching page at once, and the module for that kind of email offered. | The platform's own result, kept as AW-13 sets. |
2 | A second click within [[12]] months | The person and the awareness lead | An offer of a private [[20]]-minute coaching session within [[10]] working days of the campaign closing: what the cues were, what makes them hard to spot in this person's work, and the report button. Taking it up is voluntary. | That coaching was offered, and taken up or not. No note of the conversation. |
3 | A third click within [[12]] months | The person, the awareness lead and, with the person told first, the line manager | A support conversation about workload, the role's email volume, language or accessibility needs; extra technical protection for the account, such as moving it early to phishing-resistant sign-in (P14) and a stronger warning banner; and a pause in simulations for [[2]] months while the support works. HR joins only to arrange an adjustment. | The support agreed. The record stays with the awareness lead, not in the personnel file. |
Never, whatever the number of clicks:
- Naming them to colleagues, in a league table, or in any report above the person
- Sending extra or harder simulations as a penalty
- Removing access, pay or opportunities because of a simulation result
- Starting the disciplinary process because of simulation results
The extra protection at stage 3 is technical: the person's account moves early to phishing-resistant sign-in, the stage of the Privileged Access Standard rollout for "everyone, for remote access and email" (P14), and gets a stronger warning banner on outside email. A person who keeps clicking is better protected by a control than by another email.
Sanctions belong to the disciplinary process alone, and only where a person, after support, deliberately disregards a rule in real work. A simulation result is never that evidence on its own.
Guidance — delete before approval
Coaching works best as a conversation about the person's own inbox: which emails they receive, which are hard to tell apart, and how the Report button works on their device. Ask what would help. Workload, language and accessibility are common reasons for clicking.
Approval and ethics
No simulation may run until the programme has been approved on the ethics and approval checklist by the Head of Information Security, HR, the Data Protection Officer and Legal, and cleared with the works council or staff representatives where national law or a collective agreement requires it. The approval is renewed every [[12]] months and whenever the method changes.
Who signs | Confirms |
|---|---|
Head of Information Security | ET-01 The purpose is written: to build reporting and to teach, never to catch people out or to rank them. |
HR | ET-02 HR has approved the programme, the support stages and the never-list. ET-04 The works council or staff representatives have been consulted, or have agreed, where national law or a collective agreement requires it. ET-08 Staff have been told that simulations happen, what is recorded, who sees it and how support works, without being told when. |
Data Protection Officer | ET-05 The lawful basis is recorded, with a legitimate interests assessment where that is the basis; a public authority uses the basis its law gives it, as Article 6(1)(f) does not apply to its tasks. ET-06 Only the fields of the simulation record are kept; the platform is set never to store typed credentials or open tracking. ET-07 Named results are deleted or reduced to group figures after [[12]] months, and the platform supplier's contract says so. |
Legal | ET-03 Legal has confirmed the national rules on monitoring at work and any duty to inform or consult staff representatives (GDPR Art 88). |
Before every campaign, the checks ET-10, ET-11, ET-12, ET-13, ET-14, ET-15 of the Phishing Simulation Ethics & Approval Checklist are confirmed: the lure, the grade, the timing, the exclusions, the teaching page and the sending route.
- Staff are told in advance that simulations happen, what is recorded, who sees it and how support works, without being told when (ET-08). The Awareness Campaign Communications Kit has the announcement.
- Staff representatives, a works council, staff representatives or a trade union, are consulted, or their agreement obtained, before the first campaign, where national law or a collective agreement gives them a say in monitoring at work (ET-04).
- Renewal. The approval is renewed every [[12]] months and whenever this method changes: a new grade, a new kind of simulation, new fields recorded, or a new platform.
Data protection
Individual results are personal data. The Data Protection Officer confirms the lawful basis and the data kept before the first campaign (AW-13, ET-05 to ET-07).
Who sees what
Who | Sees |
|---|---|
The person | Their own results, at once, and on request |
Awareness lead | Results by name, to send teaching and offer support |
Line manager | Their team's group result, if the team has at least [[10]] people; a name only at the third support stage, with the person told first |
HR | Nothing by name, except to arrange an adjustment the person agrees to at the third stage |
Executive management and the board | Group results and trends only |
Everyone else | Nothing |
The lawful basis
The lawful basis is recorded, with a legitimate interests assessment where that is the basis; a public authority uses the basis its law gives it, as Article 6(1)(f) does not apply to its tasks. Where it is legitimate interests, the assessment answers three questions:
Part | Question | What the method gives it |
|---|---|---|
Purpose | What is the interest, and is it legitimate? | Protecting the organisation's systems and the people whose data it holds from phishing, by building the habit of reporting it. |
Necessity | Is processing this data needed for it, or is there a less intrusive way? | Only four facts are recorded; names are needed only to show the teaching page and to offer support, and are seen by one person. Group figures serve every other use. |
Balance | Do the people's interests, rights and freedoms override it? | Staff are told in advance; no result reaches a manager by name except at stage 3, with the person told first; no result is ever on its own a ground for discipline; named results are reduced after [[12]] months. |
- Data minimisation. Only the four fields of the record are kept, and the platform is set never to store typed credentials or to track opens (ET-06).
- Retention. Named results are deleted or reduced to group figures after [[12]] months, on the platform and in any export, and the platform supplier's contract says so (ET-07).
- Separate from training records. Simulation results are not completion records and are not kept with them (AW-17).
- Impact assessment. The Data Protection Officer decides whether a data protection impact assessment is needed, and records the decision with the lawful basis.
Worked examples
The examples are from the EXAMPLE organisation used throughout this library: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its programme was approved with the plan on 26 Jun 2026. The staff representatives were consulted on 17 Jun 2026, and the checklist was signed on 24 Jun 2026 by Head of Information Security, HR, Data Protection Officer and Legal, on the basis of legitimate interests (GDPR Art 6(1)(f)), with the assessment recorded by the Data Protection Officer. It is due for renewal by 24 Jun 2027. Every figure below is worked out from the campaign counts by the rules above.
Campaign | Sent | Closed | Send group | Grade | Sent to | Reported | Clicked | Credentials | First report |
|---|---|---|---|---|---|---|---|---|---|
SIM-2026-07 | 14 Jul 2026 | 21 Jul 2026 | Group A | 1 | 444 | 98 (22%) | 63 (14%) | 18 | 9 min |
SIM-2026-08 | 25 Aug 2026 | 1 Sep 2026 | Group B | 1 | 446 | 116 (26%) | 54 (12%) | 14 | 6 min |
SIM-2026-09 | 17 Sep 2026 | 24 Sep 2026 | Group A | 2 | 441 | 124 (28%) | 58 (13%) | 17 | 4 min |
Example 1: moving to Grade 2
Step | EXAMPLE |
|---|---|
After July | SIM-2026-07 was the only campaign at Grade 1. The rule needs [[2]], so August stayed at Grade 1. |
After August | The two Grade 1 campaigns, taken together: 214 reports and 117 clicks from 890 emails. Reporting 24.0% (at least 20%: met); clicking 13.1% (at most 15%: met). |
September | Grade 2. The lure left three cues (it came from a pallet carrier we do not use; the link's address did not match the carrier's name; a delivery note asked you to sign in before you could see it), which is Grade 2 by the grades table. |
Step back? | September's click rate was 13.2%, against 13.1% at Grade 1: not double, so no step back. |
October | Grade 2: only one campaign so far at Grade 2, so the rule cannot move the group yet. |
What it shows. The rule pooled the two send groups, because they are halves of one grading group. Neither group was promoted on its own results.
Example 2: the bonus lure
Step | EXAMPLE |
|---|---|
Proposed | For SIM-2026-09: "Your September bonus statement is ready to view". |
Checked | By HR on 8 Sep 2026, 7 working days before the send (ET-10). |
Outcome | Rejected: FL-1, pay, bonuses, benefits, pensions, or gifts and vouchers from the organisation. It plays on what people are owed, damages trust in real pay messages, and has caused public backlash where it was used. |
Replaced with | "A delivery note from a pallet carrier, with a link to the attached document", on the month's theme, unexpected attachments (CA-07). |
What it shows. The check is made on the lure, not on whether it would work. A bonus statement would have been an effective lure; that is why it is forbidden.
Example 3: keeping clear of open incidents
The quarter had three incidents of Severity 1 or 2 (P09). No campaign was sent while one was open:
Incident | Severity | Open | Campaigns either side |
|---|---|---|---|
INC-2026-014 Ransomware on 14 office PCs at Warehouse 2 | 1 | 12 Aug 2026 to 21 Aug 2026 | SIM-2026-07 sent 14 Jul 2026; SIM-2026-08 sent 25 Aug 2026 |
INC-2026-016 Customer order spreadsheet sent to the wrong business customer | 2 | 9 Sep 2026 to 16 Sep 2026 | SIM-2026-08 sent 25 Aug 2026; SIM-2026-09 sent 17 Sep 2026 |
INC-2026-017 Staff mailbox taken over after a phishing email | declared 2, final 3 | 22 Sep 2026 to 24 Sep 2026 | SIM-2026-09 sent 17 Sep 2026; the next campaign, in October |
What it shows. The August send went out 2 working days after INC-2026-014 closed, and September's the next working day after INC-2026-016 closed. Had INC-2026-017 been declared a week earlier, September's send would have waited for it to close.
Example 4: repeat clickers
Step | EXAMPLE |
|---|---|
Who | Group A received both SIM-2026-07 and SIM-2026-09. 436 people were sent both; 11 clicked both times; nobody has clicked three times. |
Stage 2 offer | All 11 offered private coaching on 28 Sep 2026, 2 working days after SIM-2026-09 closed on 24 Sep 2026 (due by 8 Oct 2026). |
Taken up | 8 accepted; 3 sessions held by 30 Sep 2026. Taking it up is voluntary, and nothing is recorded about those who did not. |
Measured | HRM-03 Repeat clickers: 2.5% (11 of 436), status Below target, within tolerance against [[2%]] or fewer (tolerance [[5%]]). |
Seen by | The awareness lead alone. No manager was told a name: nobody has reached stage 3. |
Example 5: reading September's results
Measure | September | Status | How to read it |
|---|---|---|---|
HRM-01 Simulation reporting rate | 28% (124 of 441) at Grade 2 | Below target, within tolerance | Not comparable with August's 26%, at Grade 1 (a change of grade is a break in series, AW-15). The same people reported 22% in July at Grade 1, and more at the harder grade in September. |
HRM-02 Time to first report | 4 minutes at Grade 2 | On target | Down from 9 in July and 6 in August. A real attack sent at the same time would have been known within minutes. |
Credentials entered | 17 of 58 clicks (29%) | Context | July 29%, August 26%. Nearly a third of clicks would have given an account away. The fix is the move to an authenticator app; the sign-in codes theme follows it in Feb 2027. |
Real reports | 83 (16 real) | Context | Up from 41 in July and 57 in August: the habit reaching real mail. |
What it shows. The reporting rate rose at a harder grade, but it is not compared with August's: the grade changed. Phishing compromises (P11 MC-34) were amber in September, so the measures are read together, never one at a time.
Questions to be ready for
An auditor, the Data Protection Officer or staff representatives will usually ask these. The answer is in the method and its records.
Question | The answer the method gives |
|---|---|
Who approved the programme, and when was it last renewed? | The signed ethics and approval checklist: the four signers, the date, and the consultation with staff representatives where required (AW-09). It is renewed every [[12]] months and whenever the method changes. |
How do you know the programme works? | Reporting rate and time to first report, compared at the same grade, and real suspicious emails reported each month. The click rate is shown for context only (AW-15). |
Can a manager find out who clicked? | No. A manager sees the team's group result if the team has at least [[10]] people, and a name only at the third support stage, with the person told first (AW-13). |
What happens to someone who clicks every time? | Private coaching after the second click within a year; a support conversation, a better-protected account and a pause in simulations after the third. Never a sanction for the result (AW-14). |
What do you keep, and for how long? | Sent, clicked, credential entered and reported, with times. Never what was typed, never whether an email was opened. Named results for [[12]] months, then group figures only (AW-13). |
Has a lure ever been rejected? | Every lure is checked by HR before it is sent. The campaign record shows the checks, and any lure rejected, with the reason (AW-10). |
Why not send everyone the same email on the same day? | Colleagues warn each other, so a single send measures the warning, not the behaviour. Sends are spread over the day and across two groups. |
Evidence to have ready
- This method, approved, and the signed Phishing Simulation Ethics & Approval Checklist, with its renewal date.
- The lawful basis, and the legitimate interests assessment where that is the basis.
- The announcement staff received, with its date (ET-08).
- For each campaign: the lure brief, HR's check, the exclusions, the grade and how the rule gave it, and the group results.
- The support offered to repeat clickers, as counts, with the dates offered.
- Evidence that named results older than [[12]] months were reduced.
Limitations
No simulation programme measures behaviour perfectly. These are this method's known weaknesses, and how they are managed.
Limitation | Effect | How it is managed |
|---|---|---|
Mail security tools click links to scan them | Clicks are counted that no person made | Allow the platform's sending route through the scanner, and have the platform discard clicks in the first seconds after delivery or from known scanner addresses. Check the first campaign's clicks by hand. |
Colleagues warn each other | Reporting and click rates reflect the warning as well as the habit | Spread the send over the day. A warning that spreads is itself the behaviour wanted: it is not discouraged. |
A practice email is not a real attack | People may report practice emails more readily than real ones | Count real suspicious emails reported each month beside the simulation figures, and judge the programme on both. |
Grades are a judgement | Two lures of the same grade can differ in difficulty | Count the cues on the lure brief; calibrate graders once a year on the cases below; compare results only at the same grade (AW-15). |
Small groups | A result for a small team can point to a person | No result below [[10]] people goes to anyone but the person and the awareness lead (AW-13). |
Some people are never simulated in a period | Joiners, long absences and exclusions leave gaps | Count recipients each campaign, and say who was left out and why, by category, never by name. |
Calibration and review
Calibrating the people who grade and check lures
- Before their first campaign, and every year after, the awareness lead and the HR reviewer work through the cases below on their own.
- Compare with the expected answer and discuss each difference. A pattern of differences shows a cue or a forbidden topic that needs clearer wording: change it here, and record the change below.
- Where the two disagree on whether a lure is forbidden, it is not used.
Case | Lure | Cues | Grade | Forbidden? | Why |
|---|---|---|---|---|---|
1 | "Your parcel could not be delivered" from a generic sender, with spelling errors, a mismatched link and "act within 24 hours". | 5 | Grade 1 | No | Five cues: Grade 1. |
2 | "A document has been shared with you" in the style of a common file-sharing service, no real brand named, with a lookalike link and an unexpected sender. | 3 | Grade 2 | No | Three cues: Grade 2. |
3 | An invoice query from a supplier of the kind the finance team deals with, from a lookalike domain, otherwise correct. | 1 | Grade 3 | No | One cue, not tailored to one role: Grade 3. |
4 | A message to the payments officer, in the style of a named supplier's real account manager, asking to confirm new bank details. | 1 | Not used | FL-6 | Tailored with one cue would be Grade 4, but it imitates a real supplier: rejected. Rewrite it with a fictional supplier. |
5 | "Your pension statement is ready" from the HR system. | 2 | Not used | FL-1 | Pensions are a forbidden topic, whatever the grade. |
6 | "Urgent: the security team has detected a problem with your account". | 3 | Not used | FL-5 | It imitates the security team's own warnings: rejected. |
7 | "Help the flood appeal: donate through this link". | 4 | Not used | FL-4 | A real emergency or charity appeal: rejected. |
Signals that the method needs attention
- Reporting below [[10%]] for two campaigns running at any grade: the reporting route may be hard to use, or not known.
- A complaint from staff or their representatives about a lure or about how results were used.
- The same group failing to progress for [[4]] campaigns: the grade may be wrong, or the training not reaching them.
- Credentials entered on more than [[a third]] of clicks: the fake sign-in theme needs repeating, and the sign-in control strengthening.
Review
This method is reviewed at least every 12 months, with the approval it rests on (AW-09), and also after any complaint about a lure or about how results were used, and whenever the platform changes. A change to the grades, the thresholds or the measures is a break in series for the results either side (AW-15). The review is approved by the head of Information Security, with HR and the Data Protection Officer.
Date | Reviewed by | Cases worked | Differences | Change made | Approved by |
|---|---|---|---|---|---|
[[YYYY-MM-DD]] | [[Roles]] | [[n]] | [[n]] | [[None / description]] | [[Name]] |
Related documents
Document | Relationship |
|---|---|
Annual Security Awareness Plan | The theme each campaign follows (AW-02) |
Role-Based Security Training Matrix | The roles at higher risk that may be graded on their own (AW-06) |
Awareness Campaign Communications Kit | The programme announcement, the close note and the note to line managers (AW-08, AW-13) |
New Joiner Security Induction Deck | What joiners learn before their first practice email (AW-05) |
Phishing Simulation Ethics & Approval Checklist | The approvals before the programme and before every campaign (AW-09, AW-10) |
Human Risk Metrics Dashboard | The measures each campaign feeds (AW-15) |
Security Incident Management Policy (P09) | The reporting route and the no-blame rule (IM-01) |
Joiner-Mover-Leaver Operating Procedure (P13) | Joiners' start dates and long absences (JML-07, JML-11) |
Privileged Access Standard (P14) | Phishing-resistant sign-in, used as the extra protection at stage 3 |
Security Metric Definition & Measurement Method (P11) | Status words and breaks in series (MR-09, MR-12) |
Security Exception & Waiver Standard (P02) | Exceptions to the rules that admit them (AW-18) |
Adapting this template
Guidance — delete before approval
Small organisation: one send group and one campaign a quarter is enough. Keep the ethics checklist, the teaching page, the support stages and the [[10]]-person minimum: in a small team, almost every result points to a person, so managers may see none at all.
Works council or staff representatives: in several countries their agreement is needed before monitoring at work starts. Take them the whole method, not only the announcement, and record what was agreed in the checklist.
Public authority: legitimate interests is not a lawful basis for processing carried out in the performance of a public authority's tasks (GDPR Article 6(1)). The Data Protection Officer records the basis the authority's own law gives it.
Simulation run by a provider: the provider is a processor. Its contract sets the four fields it may record, the retention period and deletion, and forbids storing typed credentials or open tracking (ET-06, ET-07). The awareness lead, not the provider, sees names.
Regulated entity (NIS2): Implementing Regulation (EU) 2024/2690 expects the awareness programme to be tested for effectiveness where appropriate (Annex, point 8.1.3). The campaign measures, compared at the same grade, are that test; keep each campaign's record and the approval. It binds only the digital providers its Article 1 names; for others it shows what a regulator expects.
Text-message, voice and QR-code simulations: the same rules apply. Grade them by their cues, check them against the forbidden lures, and give them a teaching page or a call-back that teaches.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | The whole method: practice that builds awareness |
ISO/IEC 27001:2022 | Annex A 6.8 — Information security event reporting | Reporting as the success measure; the reporting route in every campaign |
ISO/IEC 27001:2022 | Annex A 6.4 — Disciplinary process | Support for repeat clickers: no sanction for a simulation result |
ISO/IEC 27001:2022 | Annex A 5.34 — Privacy and protection of PII | Data protection: what is recorded, who sees it, and for how long |
NIST CSF 2.0 | PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind” | The whole method: awareness built through practice |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | The whole method: cyber hygiene practices and training |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.1.3 — “The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The awareness raising programme shall be updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape and risks posed to the relevant entities.” | Measuring a campaign: the awareness programme tested for effectiveness |
GDPR — Regulation (EU) 2016/679 | Article 5(1)(c) — personal data shall be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)” | What is recorded: the minimum, and never typed credentials or opens |
GDPR — Regulation (EU) 2016/679 | Article 6(1)(f) — processing is lawful where it “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”. “Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.” | The lawful basis, and the public authority exception |
GDPR — Regulation (EU) 2016/679 | Article 88(1) — Member States “may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context” | Staff representatives, and national rules on employees' data |
GDPR — Regulation (EU) 2016/679 | Article 88(2) — those rules “shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place” | Approval and ethics: transparency and monitoring at work |
GDPR — Regulation (EU) 2016/679 | Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits” | The Data Protection Officer's role in the approval |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
Definitions
Term | Meaning in this method |
|---|---|
Clicked | The person opened the link or attachment in a simulated email. Opening the email alone is not recorded. |
Credential entered | The person typed something into the simulated sign-in page. What they typed is never stored. |
Cue | A sign in an email that it is not genuine: an unexpected sender, a mismatched link, urgency, a request for a password or payment. |
Grade | How hard a simulation is to spot, from Grade 1 (many cues) to Grade 4 (one cue, tailored to a role). |
Group result | A simulation result for a group of at least the minimum size, with no name in it. |
Lure | The story a simulated email tells to get a click: a parcel, a shared document, an invoice. |
Repeat clicker | Someone who clicked in two or more simulations within 12 months. |
Reported | The person used the reporting route for the simulated email. This is the behaviour the programme exists to build. |
Reporting rate | People who reported a simulation, out of the people it was sent to. |
Grading group | The people whose results set a grade together: everyone in the baseline course, unless a role at higher risk is graded on its own. |
Send group | One of the [[2]] parts of a grading group, chosen at random and simulated in turn, one a month, so each person receives a simulation every [[2]] months. |
Simulation | A harmless email, written to look like phishing, sent to people who know simulations happen but not when, to practise spotting and reporting it. |
Support route | The private help offered to a repeat clicker by the awareness lead, and by the line manager only at the third stage. |
Teaching page | The page a person sees at once after clicking a simulation: the cues they missed and how to report next time. No score and no warning. |
Time to first report | The minutes from a simulation being sent to the first report of it. It shows how soon a real attack would be known. |
Works council | The body that represents staff where national law or a collective agreement gives it a say in monitoring at work: a works council, staff representatives or a trade union. |
AW-nn, ET-nn, FL-n, HRM-nn | Rule, check, forbidden-lure and measure numbers of the Security Awareness Programme pack. |