What is a phishing simulation?
A phishing simulation is a controlled test in which the security team, or a vendor platform it runs, sends employees messages built to look like real phishing. The messages are harmless: links lead to a training page, and any credential form should record only that a submission happened, not the password itself. Simulations do two jobs. They measure how people respond to realistic lures, and they give staff safe practice at the behavior the program wants most, which is reporting.
What a campaign measures
- Click rate: share of recipients who opened the link or attachment.
- Submission rate: share who entered credentials or other data, the more serious failure.
- Report rate: share who used the report button.
- Time to report: how soon the first and typical reports arrived after delivery.
Click rate swings with how hard the lure is, so it should be compared only between campaigns of similar difficulty. Report rate and time to report are better signs of progress, because an early report lets analysts find and remove every copy of a real phish.
Running simulations well
Begin with an unannounced baseline before new training starts. Model templates on threats the organization actually receives, including text-only payment requests with no link, QR code lures and fake sign-in pages, and rate each template's difficulty. Stagger send times so one person cannot warn the whole floor. Have the mail team let the simulation through the gateway, and filter out clicks made by automated link scanners, which otherwise blame people who never opened the message. Wire the report button to the platform so reporting a simulation counts as a success, and show a short page after a click that points out the clues.
Ethics and culture
A simulation deceives employees, so legal, HR and privacy teams should approve the program, and staff should know simulations happen even though individual campaigns are unannounced. Avoid lures that promise bonuses or threaten jobs or health; they cost more trust than they teach. Answer failures with brief corrective training and, for repeat cases, coaching. Public naming or discipline for being fooled teaches people to hide real clicks, which is exactly the outcome the program exists to prevent.
Phishing simulation vs. phishing
Phishing is a real attempt to steal credentials, money or access. A phishing simulation copies its look under authorization, harms no one and exists to measure and train. In audit terms it is behavioral testing, because it observes how people act, unlike functional testing, which checks whether a single technical control such as a DLP rule does its job.
Phishing simulation on the CompTIA Security+ exam
Phishing simulations are part of SY0-801 objective 5.6, awareness practices, and they are the clearest example of behavioral testing under objective 5.5. Scenarios ask what a campaign should track (report rate and time to report, not only clicks), how to respond to employees who fail (corrective training, never public shaming), or how to read results across campaigns of different difficulty. Distractors include penetration testing, which targets systems rather than measuring a workforce, functional testing of a specific control, and responses that punish people.