The short answer
A phishing simulation service sends realistic but harmless phishing emails, QR codes or follow-up calls to your staff under written authorisation, then measures who clicks, who enters credentials and who reports. You get results by team and scenario, the warning signs people missed, and the training, process and control changes that would have stopped a real attack.
On this page
- What is included in a phishing simulation service?
- Which phishing test campaigns can you run?
- How do you run a phishing test for employees?
- How is a phishing simulation planned and approved?
- Is phishing simulation legal in the UK?
- What does a phishing simulation report show?
- How often should you run phishing simulations?
- How does phishing simulation support PCI DSS and ISO 27001?
- How does phishing simulation fit with social engineering testing?
- What affects the cost of a phishing simulation?
- Why Sovereign Secure
- Next step
A phishing simulation service tests how your staff respond to the phishing that real attackers send. We design realistic but harmless campaigns, such as a shared-document lure that asks for a Microsoft 365 password, a supplier invoice with a tracked attachment or a QR code for a staff benefits portal, and send them under written authorisation. We then measure who clicks, who enters credentials and, most importantly, who reports. You get results by team and scenario, the warning signs people missed, and the training, process and email-control changes that would have stopped a real attack.
Phishing simulation is the email-led, repeatable part of our social engineering penetration testing. It can run on its own as a one-off phishing test or a programme across the year, or alongside phone and on-site scenarios when you want a wider view of human risk.
What is included in a phishing simulation service?
A phishing simulation service covers scoping, scenario design, delivery, a teaching page for anyone who clicks, and a report with a debrief:
| Stage | What happens | What you provide |
|---|---|---|
| Scoping | Objectives, target groups, campaigns, delivery windows and off-limits topics agreed, then a fixed price | A sponsor and the in-scope groups |
| Reconnaissance | Light open-source research so lures look like your real mail | Nothing |
| Scenario design | Draft emails, landing pages and pretexts sent to you for approval | Sign-off, and HR where needed |
| Technical set-up | Sending domains, landing pages and tracking prepared | An administrator to add allow-listing |
| Delivery | Emails staggered across the window so news of the test does not outrun them | A trusted helpdesk or security contact |
| Teaching moment | Anyone who clicks or submits sees a short page explaining the signs they missed | Approval of the wording |
| Reporting and debrief | A report and walkthrough of results, reasons and fixes | Time with the sponsor and IT |
| Repeat campaign | An optional follow-up to measure change | Agreement on timing |
Which phishing test campaigns can you run?
Choose the campaign types that match how attacks would reach your organisation. Most programmes mix several across a year.
| Campaign type | What staff receive | What it measures |
|---|---|---|
| Credential capture | A link to a convincing sign-in page, such as a shared file or voicemail notification | Who clicks, who enters a username and password, who reports |
| Attachment | A harmless document that records when it is opened, framed as an invoice, CV or policy update | Who opens attachments from unexpected senders |
| Link click | A link to a teaching page with no login request, often used for a first baseline | General caution with links |
| QR code | A code in an email or attachment, or on a printed notice placed by agreement, that leads to a login page on a phone (quishing) | Whether staff scan codes on personal devices and sign in there |
| Reply or payment pretext | No link at all: a request to change a supplier’s bank details or to reply with information | Whether finance staff and assistants follow call-back verification |
| Vishing add-on | A follow-up phone call posing as IT support or a supplier, by agreement | Helpdesk identity checks and MFA approval habits |
Difficulty is set per campaign, from obvious lures for a baseline to researched spear phishing aimed at finance, HR and IT administrators. Our guide to phishing simulation examples walks through seven scenarios from easy to hard.
How do you run a phishing test for employees?
Run it in six steps: get written approval, agree the rules, design scenarios that look like your real mail, send them in a staggered window, show a short teaching page to anyone who clicks, then report by team and repeat. Phishing tests for employees work best as a programme rather than a one-off, so each simulated phishing test can be compared with the last.
- Approve. A senior sponsor signs off the scope, the target groups and how results will be handled.
- Plan. Agree off-limits topics, allow-listing and who on the helpdesk knows the test is live.
- Design. Build lures from light research into your suppliers, systems and working patterns, and approve them before anything is sent.
- Send. Stagger delivery so word of the test does not spread faster than the emails.
- Teach. Anyone who clicks or submits sees a short page explaining the signs they missed.
- Report and repeat. Compare click, submission and reporting rates by team, fix the process gaps and plan the next campaign.
A phishing testing service takes this work off your team and adds an outside view of what attackers would try. The planning decisions behind the first two steps are set out below.
How is a phishing simulation planned and approved?
Written authorisation and agreed rules come before any email is sent. We work through five decisions with your sponsor:
- Objectives. An organisation-wide baseline, a focused test of one process such as supplier payments, or a check on whether recent training worked.
- Rules of engagement. Off-limits topics (redundancies, pay, health, bereavement), permitted brands, who is excluded, and how anyone who becomes distressed is supported.
- Data handling. Who sees results, at what level of detail and for how long. A well-run campaign records that credentials were submitted, never the password itself.
- Delivery set-up. Whether simulations are allow-listed so they reach inboxes, which measures people rather than filters, or deliberately sent without allow-listing to see what your email security catches. In Microsoft 365, third-party simulations are normally configured through the advanced delivery policy in Microsoft Defender rather than through general allow-list or mail flow rules.
- Escalation. A trusted contact on the helpdesk or security team who knows the campaign is live, so reports are handled normally and a real phish is never dismissed as “just the test”.
Is phishing simulation legal in the UK?
Yes, when the organisation authorises it, it targets accounts and systems the organisation controls, and staff data is handled lawfully. The points that matter in practice:
- Authorisation. A senior sponsor approves the scope in writing. Campaigns go to work accounts only, never to staff’s personal email or social media accounts.
- Data protection. Results linked to named people are personal data under UK GDPR. Explain in your staff privacy information that simulations take place, keep individual results to the minimum needed and set a retention period. The ICO’s guidance on monitoring workers explains what it expects when employers collect data about staff behaviour, including telling them and keeping it proportionate.
- Employment relations. Using a simulation to discipline someone undermines the programme and invites grievances. Agree with HR in advance that repeat clicks lead to support, not sanctions.
- Third-party brands. Agree in advance which outside brands, such as banks, suppliers or public bodies, may appear in lures.
This is general guidance, not legal advice.
What does a phishing simulation report show?
The report shows what people did, why the scenario worked and what to change. Behaviour is measured at each step:
| Measure | What it tells you | Caveat |
|---|---|---|
| Delivered | How many simulations reached inboxes | Filters may remove some if not allow-listed |
| Opened | Rough reach of the message | Unreliable: image blocking and mail privacy features distort it |
| Clicked | Who followed the link or scanned the code | Email security tools that pre-scan links can record false clicks, which need separating out |
| Submitted credentials | Who would have handed over a password | The most serious outcome in most scenarios |
| Opened attachment | Who trusted an unexpected file | Varies with how devices handle attachments |
| Reported | Who used the report button or told the helpdesk | The behaviour you want to grow |
| Time to first report | How quickly your security team would have known | An early report lets you block a real attack for everyone |
Results are broken down by team, role and scenario and compared with earlier campaigns. The report also covers the process gaps exposed, such as a payment change accepted by email, and the controls that would reduce the risk, such as external sender tagging, phishing-resistant MFA for administrators or an enforced DMARC policy. If tenant settings are a concern, our Microsoft 365 security assessment reviews them in depth.
What is a good click rate for a phishing test?
There is no universal good click rate, because it depends on how hard the scenario was. A rate from an obvious parcel-delivery lure cannot be compared with one from a researched supplier email. Compare like with like over time, and give more weight to the reporting rate, credential submissions and time to first report. A programme where clicks hold steady but reports keep rising is working.
How often should you run phishing simulations?
For most organisations, at least two campaigns a year is a sensible starting point, with extra campaigns for high-risk roles and after significant changes.
| Situation | Suggested cadence | Why |
|---|---|---|
| First campaign | One organisation-wide baseline | Sets the starting point for every later comparison |
| Established programme | At least twice a year, varying scenario and timing | Shows a trend and keeps reporting habits fresh |
| Finance, HR, IT administrators, executive assistants | Additional targeted campaigns | These roles hold the payment, data and system access attackers want |
| After training or a process change | A follow-up within a few months | Measures whether the change worked |
| After a merger, a new system or a real incident | A campaign built around the change | Attackers exploit change and uncertainty |
How does phishing simulation support PCI DSS and ISO 27001?
Neither standard names phishing simulation, but both expect evidence that awareness works. PCI DSS v4.0.1 requires security awareness training on hire and at least once every 12 months (Requirement 12.6.3), covering phishing and related attacks and social engineering (12.6.3.1). It also requires processes and automated mechanisms to detect and protect personnel against phishing (5.4.1). Both 12.6.3.1 and 5.4.1 became mandatory on 31 March 2025, and the standard is in the PCI SSC document library.
Simulation results show your assessor that training changes behaviour, and a campaign sent without allow-listing gives evidence about your anti-phishing mechanisms too. Our guide to PCI DSS training covers what Requirement 12.6 expects of the training itself, and our guide on how to spot phishing emails lists the ten signs worth teaching, with annotated examples. Under ISO/IEC 27001:2022, results support Annex A 6.3 (information security awareness, education and training).
How does phishing simulation fit with social engineering testing?
Phishing simulation is the regular, organisation-wide measure. Wider testing answers other questions:
| Service | The question it answers |
|---|---|
| Phishing simulation | How do our staff respond to phishing, and is it improving? |
| Social engineering testing | Can specific teams or processes be manipulated by email, phone or in person? |
| Red team assessment | Could an attacker who phishes one person reach our critical systems, and would we notice? |
If you already use a self-service phishing simulation platform, such as the attack simulation training in some Microsoft 365 licences, a consultant-led campaign complements it with researched scenarios your staff have not seen in a template library.
What affects the cost of a phishing simulation?
We quote a fixed price after scoping. The main drivers are:
| Factor | Effect on effort |
|---|---|
| Number of campaigns | Each campaign needs its own design, approval, delivery and analysis |
| Tailoring | Researched, organisation-specific scenarios take longer than adapted standard ones |
| Recipients and groups | More people and more separate groups mean more set-up and a larger analysis |
| Channels and languages | Vishing calls, printed QR codes or scenarios in several languages add preparation time |
Why Sovereign Secure
- We are a PCI SSC Qualified Security Assessor (QSA) company, so we know what evidence an assessor looks for under Requirements 5.4.1 and 12.6.
- We are ISO 27001 certified, handle campaign data securely and report by team rather than by name.
- Phishing sits within our wider testing, including social engineering, red team and network testing, so a successful phish can be followed through to what an attacker could reach.
- Every campaign runs under written rules of engagement agreed with you before anything is sent.
Next step
Tell us how many staff are in scope, which teams matter most and whether you want a one-off baseline or a programme across the year. Send the details through our penetration testing quote form and we will confirm the scope and return a fixed-price proposal.
Last reviewed October 2026 by the Sovereign Secure assessment team.
