How to run your first phishing simulation (without upsetting anyone)
A practical checklist for a first campaign that teaches people instead of embarrassing them.
ยท Program Design
A first phishing simulation sets the tone for your whole programme. Done well, people see it as useful practice. Done badly, it feels like a trap.
Before you send anything
- Get sign-off from leadership, HR and (where relevant) works councils or unions.
- Tell people simulations will happen. You don't announce the date, but you do explain why.
- Allow-list your simulation sending so messages actually reach inboxes.
- Agree what you'll measure: clicks, but more importantly reports.
Choosing the first email
Start with something realistic but fair: a generic delivery notice or a shared-document alert. Avoid anything that plays on fear or personal circumstances (bonuses, layoffs, health). Those break trust.
When someone clicks
The click is the teaching moment. Show a short, friendly page explaining the signs they missed. PhishFoil records that a click happened, never anything a person types, so nobody's real password is ever collected.
After the campaign
- Share results as team-level trends, not a list of names.
- Celebrate the people who reported the email.
- Follow up with a short training video for those who clicked.
- Run the next campaign a little harder.
The goal isn't a zero click rate on day one. It's a steadily rising report rate.