What is a phishing simulation?

A phishing simulation is a controlled test where an organization sends its own employees an email that looks like phishing but is safe. The link goes to a training page instead of a fake login, and any attachment is harmless. Nobody loses a password or money.

It works like a fire drill. People get to practise the right response (pause, check, report) in a setting where a mistake costs nothing. Microsoft describes simulations in its own tool as campaigns that deliver realistic but harmless phishing messages to users.

Simulations are usually one part of a wider security awareness program. The other parts are short lessons, a clear way to report suspicious email, and technical controls that stop most phishing before it reaches anyone.

Most simulations follow the same basic cycle, whether a business runs them itself or a managed service provider (MSP) runs them on its behalf.

The headline number is usually the click rate: the share of recipients who opened the link. It is useful, but it is not the whole picture, and on its own it can mislead.

The UK National Cyber Security Centre (NCSC) suggests that security metrics should include successes, such as how many people reported a phishing email, not just how many clicked. A rising report rate shows staff are acting as an early warning system, which is the behaviour that helps most during a real attack.

A simulation that embarrasses people will make them less likely to report a real mistake. The NCSC states plainly that blaming users for clicking on links doesn't work, and warns that simulations can erode trust between staff and the people running security.

The NCSC also notes that punishing people for clicks can create legal risk, and advises checking with HR before running simulations. In practice, a fair program follows a few simple rules.

Two technical issues trip up most first campaigns. The first is delivery. Email filters are designed to block phishing, so they may quarantine or flag the practice emails unless they are told to allow them. In Microsoft 365, the supported way to do this is the advanced delivery policy for third-party phishing simulations.

The second is false clicks. Email security tools often open links automatically to check them, which can make it look as though someone clicked when nobody did. Without filtering those automated visits, click rates can be badly inflated and staff can be told they failed a test they never saw.

It also helps to agree on a reporting method first. In Microsoft 365 that is usually the built-in Report button in Outlook, so staff learn the same action they would use for real phishing.

Large companies often have a security team that runs simulations in house. Most small businesses do not, so the work is commonly handled by their MSP as part of a managed security service. The MSP sets up delivery, schedules the emails, handles the reporting and explains the results at regular reviews.

This also matches what many cyber insurers and frameworks ask for. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations say organizations should invest in cyber security awareness and training for their employees, including how to identify malicious emails and links.

NetMinder Security is a phishing simulation and awareness training platform that MSPs resell to small business clients under their own brand. It sends monthly practice emails modelled on real scams (never impersonating real brands), shows a two minute lesson with a three question check the moment someone clicks, filters out email security scanners so their link checks do not count as clicks, and produces a branded cyber insurance report. It works with Microsoft 365 only.