1. Determine the objectives of your phishing simulations

To use phishing simulations effectively, one of the first things to identify is the actual risk you are trying to mitigate with the email lures. Often, other tactics are more effective risk mitigations, for example:

• Technical controls to block malicious content
• “Fire drills” that test reporting processes instead of just detection
• Spear phishing simulations to target the increase in highly personalised phishing attacks
• Training focused on broader digital hygiene (e.g. secure document sharing, account management)

As the recent research suggests, if your main concern is keeping employees from clicking on phishing links, generic email simulations may not be the best solution. But these tests can move the needle on other goals, such as:

• Encouraging timely reporting of suspicious emails
• Creating ongoing awareness touchpoints
• Supporting a broader behavioural programme

Considering that many employees don't know how the reporting process works within their organisation, a phishing drill triggers the employee to explore or carry out this process. So instead of a simple, pass-or-fail test, a drill tests to see if the understand the reporting process and that becomes part of their learning journey in a broader training programme.

Overall, it’s important to be specific. Are you testing if employees can spot common lures or if they can follow your organisation's procedures for reporting a suspicious email? Without clear objectives, a simulation becomes a compliance tick-box with little or unclear impact.

2. Integrate phishing simulations into a broader Human Risk Management strategy

If regulatory compliance is the only goal, a single annual training will only serve to fulfil the requirement and measure awareness at a single point of time. It will not improve behaviour. On the other hand, overwhelming employees with monthly phishing simulations could desensitise them. The optimum frequency depends on the organisational culture and risk appetite, so you need to find the right balance.

With a strategic approach, email phishing simulations serve as moments of reflection—reminding employees how easily human behaviour can be exploited and reinforcing the importance of vigilance. These tests should be part of their continuous cyber safety learning, supported by other measures such as:

• Contextual, relevant training
• Technical safeguards (MFA, filtering, segmentation)
• Clear communication about risks · Supportive feedback instead of punishment

In this way, phishing tests become part of a training ecosystem that can actually influence human behaviours.

3. Ensure training supports a learning culture

During the eight-month phishing training experiment at the US healthcare organisation, more than 50% of employees clicked on a simulated phishing email link at least once. The researchers noted that: "Given enough time, most people get pwned.”

The high likelihood that people will eventually fall for a phishing lure is just one reason cyber behaviour campaigns shouldn’t be punitive. Tests can also backfire when employees who “fail” are called out or reprimanded. Trust is broken when employees feel tricked by security teams. They may become less likely to report clicking on a suspicious email or take other necessary security actions. Instead of a culture of learning and engagement, you create fear and resistance.

Organisations that prioritise cyber safety turn mistakes into learning opportunities. Phishing simulations serve as entry points for tailored follow up behaviour interventions and training focusing on common risky behaviours—such as mixing work and personal accounts, avoiding password managers, downloading unauthorised apps, or sharing documents insecurely. After all, even the most robust technical defences can be undermined if employees don’t understand how to use them.