How to build a phishing simulation programme: 6 steps and the right metrics
A once‑a‑year training doesn’t change behaviour. Here’s how to build a measured, regular programme that doesn’t blame people.
Published: · 2 min read · HilfeX Security Team
- Measure success not only by click rate but by report rate and time to report.
- Stage campaigns from easy to hard and repeat them regularly (e.g. monthly).
- Give people who click a short learning moment, not a penalty.
Many organisations handle awareness with one video a year. Attackers send new emails every day. An effective programme lets employees practise with realistic scenarios regularly and measures progress.
The programme in 6 steps
- Set goals and scope: which departments, languages and risks? Plan high‑risk teams like finance and HR separately.
- Take a baseline: an unannounced first campaign shows where you stand. It’s a reference point, not a grade.
- Stage the difficulty: move from obvious emails to tailored, harder scenarios.
- Repeat regularly: short monthly or bi‑monthly campaigns beat one big campaign a year.
- Teach in the moment: anyone who clicks sees a short lesson showing the signs in that exact email.
- Make reporting easy: a one‑click “Report phishing” button in Outlook turns the reflex into routine.
The right metrics
- Click rate: should fall, but alone it misleads; easy templates can push it down artificially.
- Data‑entry rate: people who enter credentials on the fake page. That’s the real risk.
- Report rate: people who report to the security team, the best maturity indicator.
- Time to report: how fast the first report arrives. In a real attack it buys your team time.
- Repeat clickers: signal the need for targeted follow‑up training.
Culture: learn, don’t blame
Programmes that name and shame or become disciplinary teach people to hide mistakes, the most dangerous outcome in a real attack. Share reports by department and trend, and make progress visible.
Reporting to management
A quarterly summary is enough: click and data‑entry rates by difficulty, report‑rate trend, the riskiest scenarios and next quarter’s plan. HilfeX IQ Portal produces these reports automatically by department.
Frequently asked questions
Are phishing simulations legal?
They are a common internal awareness practice. Announce the programme in general terms beforehand, meet GDPR/KVKK transparency duties, involve works councils where they exist, and evaluate results without exposing individuals.
How often should campaigns run?
For most organisations, monthly or every two months is a good balance.
What is a good report rate?
There’s no fixed threshold; what matters is that it rises steadily and overtakes the click rate.
