Building a 12-Month Phishing Simulation Program

What Is a Phishing Simulator Program?

A phishing simulation program is a structured, ongoing approach to testing employees’ ability to recognize and report simulated phishing attacks. Unlike a one-time phishing test, a program uses recurring simulations, targeted training, and performance measurements to identify risk and improve employee behavior over time.

A Roadmap for Continuous Improvement

Many organizations make the mistake of treating phishing simulations as a one-time exercise. They conduct a single phishing test, review the results with their teams, and move on to the next project or fire.

An effective phishing simulation program takes a different approach. Instead of relying on an annual test, organizations should use recurring simulations, targeted security awareness training, and measurable results to identify risk and improve employee behavior over time.

Why a Phishing Simulation Program Matters

A mature phishing simulator program helps organizations:

• Establish a baseline
• Identify high-risk behaviors
• Reinforce training
• Measure improvement
• Adapt simulations to emerging threats
• Improve reporting behavior
• Reduce human-related security risk

This 12-month roadmap provides a structured approach to building a continuous, measurable phishing simulation program, from establishing a baseline to evaluating results and planning for the year ahead.

Month 1: Establish Your Baseline

The first phishing simulation should serve as a benchmark. The objective is to understand current employee susceptibility without overtly influencing behavior. Generic phishing emails like password reset notifications, gift card scams, Microsoft 365 login prompts, or HR policy acknowledgement requests will resonate organization-wide.

Document your starting point by measuring click rate, credential submission rate, and phishing reporting rate. The baseline will become the foundation for all future improvement metrics.

Month 2: Immediate Reinforcement

Review month 1 results and provide awareness training to all users. You can focus this training on common phishing indicators and train staff on identifying suspicious URLs, unexpected attachments, common red flags, etc., and reinforce your existing verification procedures.

Conduct a second phishing simulation using similar attack types, but different templates. Measure training completion, as well as any changes in click rate or increases in the overall reporting rate. Send immediate feedback to users who fail simulations.

You can hope to see some early behavioral changes at this stage. Some organizations will reward departments with the best reporting rates to encourage participation through some healthy competition.

Month 3: Introduce Spear Phishing Simulations

This is a good time to introduce attacks that appear more personalized and target specific groups, departments, or roles within the organization. For example, you might send a request from a specific manager, department-specific communication or update, or an internal survey request.

You are now measuring click rates by department, as well as reporting activity, so you can determine any high-risk user groups that may need more focused training or support.

Month 4: Test Business Email Compromise (BEC)

Expanding on the prior month, you can build financial and/or executive impersonation attacks, requesting wire transfers, payroll changes, vendor banking updates, or other “urgent” actions that appear to come from executive or leadership team members.

This type of attack is typically one of the most financially damaging and is often targeted at finance departments, payroll, accounts payable, and even executive-level assistants.

Building awareness in these areas can go a long way in preventing loss of funds and reputational damage.

Month 5: Attachment-Based Threats

Employees often recognize suspicious links but continue to trust attachments if they are accustomed to seeing similar PDF invoices or shared documents.

Train employees to verify attachments before opening them. Measure the attachment open rate, as well as the reporting rate. You should now also be identifying any repeat offenders or high-risk users.

Month 6: Mid-Year Assessment

Conduct a campaign similar to the original baseline and compare these results directly against month 1. You should start to see meaningful reductions in phishing susceptibility if you have been providing continued and consistent training to end users.

Month 7: Introduce QR Code Phishing Simulations

QR code attacks continue to grow because users often trust mobile devices more than suspicious email links. An example phishing test could be promoting parking permits, MFA enrollment, benefits enrollment, etc.

It is important for employees to understand they should validate QR code destinations before scanning. Your phishing tool should be able to measure which employees scanned the QR code, as well as if they reported the attack.

Month 8: MFA Fatigue and Authentication Attacks

Employees increasingly encounter attacks that target authentication systems, such as MFA renewal notices, login verification requests, and account synchronization emails.

These tests help test MFA prompt awareness and remind users of authentication best practices. Teach employees to slow down before accepting requests.

Month 9: Seasonal or Current-Event Scams

Attackers leverage current events and seasonal activities, like open enrollment for benefits, tax forms, holiday promotions and campus events, financial aid deadlines, back-to-school communications, and political/election-related messaging.

Similarly to real attackers, you can time tests to be sent during times when users are most distracted. Deploying phishing tests in a similar tone helps employees recognize emotional triggers frequently used in real phishing attacks.

Month 10: Executive and Whaling Simulations

Target leadership teams with proposed executive travel requests, confidential acquisition discussions, legal requests, or confidential board communications.

Often, organizations ask that executives are exempt from phishing tests; however, it is important to demonstrate that senior leaders are prime attack targets with access to sensitive data.

Month 11: Department-Specific Campaigns

Use the previous ten months of data to create customized simulations for high-risk departments. These should reflect threats each group is most likely to encounter in their daily roles.

For example, you might target the finance department with bank account change requests, or research groups with requests for protected data.

Month 12: Annual Measurement and Executive Reporting

Conduct a final organization-wide test so you can review against the baseline overall click rate trends, credential submission trends, and reporting rate/engagement trends. You can measure return on ROI investment for your phishing platform with documented training completion rates, departmental improvements, and reduction in risk across your identified high-risk users.

This test can also help pinpoint remaining risk areas and recommended focus for the next year. This doesn’t mean just identifying specific users but rather demonstrating measurable risk reduction. A declining click rate paired with an increasing report rate is one of the strongest indicators that a phishing awareness program is succeeding.

The best phishing simulation programs are not designed to catch employees making mistakes. They are designed to help employees develop the habits needed to identify, report, and defend against real-world attacks.

Phishing Simulation Metrics

Key phishing simulation metrics to track include:

• Click rate
• Credential submission rate
• Reporting rate
• Failure rate
• Training completion rate
• Repeat susceptibility
• Department-level trends
• Improvement over time

How to Measure Phishing Simulation Program Success

Baseline → Intervention → Retest → Compare → Adjust

For example: A successful program should not be measured by how many employees “fail” a simulation. Instead, look for measurable behavioral changes over time, such as declining click and credential submission rates and increasing reporting rates.

By combining baseline testing, progressively difficult simulations, targeted training, and consistent measurement, organizations can transform phishing awareness from an annual compliance activity into a measurable cybersecurity risk reduction program.

How Often Should You Run Phishing Simulations?

The right frequency depends on organizational risk, workforce size, industry requirements, and the maturity of the security awareness program. Rather than relying on one annual test, organizations should consider recurring simulations throughout the year, combined with targeted training and measurement.

Learn more about CampusGuard’s Phishing Simulator platform and how our teams can help you structure a comprehensive training program with scheduled phishing tests. Request a free demo or get started today!