Phishing simulations are actual emails sent to employees that are meant to mimic real life, recent, and relevant phishing style attacks. These simulated phishing attacks help guard your business against social-engineering threats by training your employees to identify and report them.

Typically, a phishing simulation is paired with a point-of-failure training when someone clicks on a link or opens an attachment. These trainings commonly come in the form of a a quick quiz or short video meant to reinforce the practice of carefully reviewing emails and following proper protocol.

Phishing simulations are an excellent tool for organizations of all sizes. All it takes is one click on the wrong email to open the door for an attack. And since real phishing emails target everyone from interns to the CEO, phishing simulations should be sent to everyone in the organization.

• Managing phishing simulations (i.e. building and launching campaigns, producing and sharing reports, etc.) typically fall to either the IT or HR department.
• Metrics on clicks and training completion should be reviewed by managers or senior leadership to better understand trends and where new tools or processes might be needed to enforce safe email habits and protect sensitive company data.

• 94% of malware is delivered via email. By regularly receiving phishing simulations employees are better equipped to recognize suspicious emails and protect your business from a cybersecurity incident.
• Regular phishing simulations reinforce email best-practices. By clicking on phishing simulation email links and attachments and completing training, everyone learns how to recognize and avoid phishing attacks. Email users are more likely to slow down and pay attention to the sender, the links in the email, and any attachments—all ways malware can be delivered.
• Phishing simulations train your team to be cyber-defenders! Now that your employees know what they are looking for they will be more likely to report suspicious emails to IT who can in turn warn the rest of the company and block the sender.