Chapter 08 of 11 · Stop the Attack

Running phishing simulations that teach

Simulations work when they are realistic, regular and followed by short learning.

  • By Thilanka Dilshan
  • Updated October 7, 2026

Simulations work when they are realistic, regular and followed by short learning. The goal is fewer clicks and more reports over time, not catching people out.

What this means in practice

A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.

Key actions

  • Run simulations monthly at varying difficulty
  • Give short feedback right after a click
  • Track report rate as well as click rate

Next steps

Avoid simulations that damage trust, such as fake bonus offers. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.

Thilanka Dilshan

Get a 30-Minute Security Briefing.
No Pitch Deck.

Talk to a Sweden-based analyst. We'll review your posture, map your gaps and give you a clear picture of where you stand, in plain language.

Book a Free Briefing
No commitment Sweden-based analyst