Phishing Simulations

Description

Measures click rates, reporting rates, and credential submissions by department.

Results are used for targeted additional training.

Simulations gradually increase in complexity — from generic to targeted.

Tools: KnowBe4, Proofpoint, GoPhish (open-source).

What people often say

• The goal is not punishing employees — it is measuring and improving.
• Simulations without follow-up training have limited effect.

Covers / does not cover

Covers

• Testing employee resistance to phishing
• Measuring improvement over time
• Identifying most vulnerable groups

Does not cover

• Technical email filtering (that is email-security)
• Protection from phishing that bypasses employees
• Testing technical infrastructure