The short answer
Yes, run them. CISA's guidance on recognizing and reporting phishing points to staff who understand the risks and clear procedures for verifying and reporting suspicious messages (CISA); simulations let people practice safely. They help only if behavior changes: realistic scenarios, one-click reporting with quick feedback, coaching rather than blame, and metrics that track reporting, not only clicks.
Why the click rate misleads
A falling click rate may be progress, or easier templates, staff who recognize the test sender, people ignoring unknown senders (customers included) or a group-chat warning whenever a test lands. Meanwhile the habit that protects you most, reporting quickly, may not have improved. One early report of a real phish lets security remove it from every inbox before others click. That habit, organization-wide, beats a low click rate.
Design scenarios that teach something
Vendor invoices
Invoice and banking change requests, for finance and accounts payable.
Shared documents
Document and e-signature notices that mimic tools staff use daily.
Deliveries
Courier notices, for operations and reception.
Executive requests
Gift cards or urgent transfers, aimed at assistants and managers.
MFA and password prompts
Teach staff never to approve a prompt they did not start.
QR codes and texts
Attackers increasingly move outside email.
Vary difficulty from many warning signs to few. Each scenario needs a one-sentence teaching point on its landing page.
Ground rules that keep staff on side
Simulations are workplace monitoring; handled badly, they breed resentment. Our rules:
Announce the program
Say simulations will happen, why and how results are used (not each test).
No public shaming
And no league tables of individuals.
No cruel lures
No fake bonuses, layoffs, health scares or tragedies; they damage trust and teach little.
Coach privately
A short, friendly explanation, not a note to the manager.
Thank reporters
Automatic thanks; occasional recognition for teams that report well.
Protect the results
Employee personal information: limit access and retention.
Include leadership and IT: exempting them sends the wrong message and leaves high-value targets untested.
Rather talk it through? If your current simulations produce reports but no real change, we can redesign them around reporting and coaching. Talk to a Promatics specialist
Metrics that show real change
NIST asks learning programs to encourage behavior change and use metrics to improve over time (NIST SP 800-50 Rev. 1). Track by department and scenario type, not by individual.
| Metric | What it tells you |
|---|---|
| Report rate | Share who reported the message |
| Time to first report | How fast the first alarm was raised |
| Click rate | Share who clicked a link or opened an attachment |
| Credential entry rate | Share who went on to enter a password |
| Repeat clicks | Who needs more support, handled privately |
| Real phishing reports | Whether the habit carries over to real attacks |
Strongest signal: report rate up, time to first report down, more real suspicious messages reported to IT.
Make reporting easy and worthwhile
Reporting must take seconds: a report button, an automatic acknowledgement and someone who actually reviews reports. Staff who report a real attack and hear nothing stop reporting. Technical controls matter as much: filtering, SPF, DKIM, DMARC and MFA reduce what reaches people and limit damage. Our email security service covers that side.
What usually goes wrong
- Gotcha culture: results go to managers, people are embarrassed, staff stop trusting IT.
- One template for everyone: finance never sees an invoice lure; the warehouse gets an executive memo.
- Annual tests only: they measure little and teach less.
- No closing of the loop: reports land in a mailbox nobody reads.
Program checklist
- Program announced to staff, with purpose and data handling explained
- Report button deployed and reported messages reviewed
- Scenarios mapped to roles and real threats
- Difficulty varied over the year
- Landing pages explain the teaching point
- Private, coaching-based follow-up for clicks
- Leadership and IT included
- Report rate and time to first report tracked
- Access to individual results restricted; retention period set
When to bring in help
Built-in email tools run basic simulations. A professional pays off for scenarios fitted to your vendors and systems, careful employee-relations handling, or links to incident handling so reports are investigated and removed fast. AI writes a convincing lure in seconds; it cannot judge which lures are fair, run the program monthly, respond to a real report or tell leadership honestly what changed.
Our cybersecurity awareness training combines short lessons, realistic simulations and reporting that shows whether behavior improves. For the wider program, see building a security awareness training program that changes behavior.
Limitations
General guidance, not legal advice. Employee monitoring and privacy expectations differ by state, sector and workplace: involve HR, and legal counsel where appropriate, before launching.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Secure Our World: Recognize and report phishing, Cybersecurity and Infrastructure Security Agency (CISA)
- NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, National Institute of Standards and Technology
- NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.