What is a phishing simulation, and what can it do?

The course everyone forgets by Friday

Most businesses "do" security awareness the same way: once a year, staff click through an online course, tick a box, and get a certificate. Two weeks later someone in accounts pays a fake invoice, or the manager clicks a link that empties the shared mailbox.

A phishing simulation adds a practical test: it shows, safely, how your team reacts to a realistic email.

So what is a phishing simulation?

With your written permission, and after your staff have been told in advance that test emails will be sent at some point, we send your team a realistic but harmless fake phishing email. Maybe a "your package couldn't be delivered" notice, a fake invoice, or a "the CEO needs this urgently" message.

Nothing bad happens if someone clicks. There's no virus, no data taken. Instead, the click is counted in the team total, and the person lands on a friendly page that explains, gently: this was a test, and here's exactly what gave it away.

The explanation appears right after the click, although studies show many people close that page quickly, so the follow-up session matters.

What a good simulation is NOT

• It is not a trap to get people fired.
• It is not shaming: results are reported for the team, never by name.
• It is not a one-off gotcha; it's a cycle of test, teach, and re-test.

What a simulation can and cannot do

A large 2025 study at UC San Diego Health found that neither annual courses nor simulations reduced clicks much (UC San Diego). Use simulations alongside MFA and a call-back rule for payment changes.

It measures something a course does not

A course tells you people watched it. A simulation tells you how many people clicked one realistic test email, which is a rough signal, not a precise measure of your risk.

What it looks like for a Belgian SME

We keep it practical and respectful:

1. Baseline. A first, gentle simulation shows where you stand today.
2. Immediate micro-lesson. Anyone who clicks gets a short, no-blame explanation of the tell-tale signs in that specific email.
3. Short follow-up training. Not a two-hour course; a focused session on the handful of tricks that fool people in your sector, like fake booking platforms, supplier invoice scams, and "urgent" owner messages.
4. Repeat and compare with care. Run another round a few weeks later. Click rates change a lot with the test email used, so compare rounds with care and count reported emails as well as clicks.

This is the backbone of our cyber awareness service: simulations and live demos that show staff how scams work.

A word on doing it ethically

This only works if your team trusts it. That means the business owner authorises it in writing, staff are told in advance that tests will happen, results are reported for the team and never by name, nobody is sanctioned for a click, and a works council or union delegation, if you have one, is informed first.

The bottom line

A course tells your team phishing exists. A simulation shows them how easily a realistic email can fool anyone. For a hotel, restaurant or small business, one clicked link can mean a drained account or a guest-data breach, so combine simulations with MFA and a call-back rule for payment changes.

Curious where your team stands right now? Get in touch and we'll set up a first, no-blame simulation and show you the result for your team.