Phishing simulations are the assessment stage of a cyber security awareness training programme. They show how people behave under realistic conditions, trigger short training at the moment of a mistake and produce the measurement that proves whether the wider programme is working. Run alone, they test people. Run together with training, they change behaviour.
Why simulations and training fail separately
Plenty of organisations run one without the other and the failure modes are predictable.
Simulations without training produce a test that nobody learns from. Staff are caught, told they were caught, and given nothing that would help them next time. The click rate wobbles up and down with template difficulty, the security team collects a year of numbers and the organisation is no more resilient than it was in January. Worse, the exercise starts to feel like a trap, which is the fastest way to destroy the reporting culture you actually need.
Training without simulations produces completion certificates and no evidence. Everyone finished the module, so the compliance box is ticked, but nobody knows whether behaviour changed. Knowledge and behaviour are not the same thing. Someone can name all six signs of a phishing email in an assessment and still click an invoice reminder while trying to leave for the school run.
The government's Cyber Security Breaches Survey 2025/2026 puts the scale of the underlying gap in context. Only 19% of businesses ran staff training or awareness raising activity on cyber security in the year, a figure that has not moved, while phishing remained the most prevalent attack type, experienced by 38% of businesses. Most organisations are not yet doing either part well.
The four stages, and where simulations sit
Boxphish structures awareness programmes in four stages and the sequence matters more than any individual component.
Assess
A baseline simulation, sent before any announcement of new training, tells you where you are starting. Not to embarrass anyone, but because every decision that follows depends on knowing which teams, sites and roles carry the most exposure. This is also where you learn which pretexts work on your organisation specifically, which is far more useful than a generic risk assessment.
Educate
Training then goes where the assessment pointed. Everyone gets the core curriculum, and the people the baseline identified get more, sooner and specific to what caught them. Short modules beat long ones, and modules delivered in the flow of work beat modules that require someone to remember a portal login.
Reinforce
Behaviour fades and a single annual course produces a spike of awareness after it has been completed but it vary rarely lasts more than a few months, which is why reinforcement runs continuously: Brief content between simulations, timely reminders when a real threat is circulating and the occasional harder simulation to keep the instinct alive.
Measure
Measurement closes the loop and starts the next one. Click rate, report rate, time to report, credential submission and completion sit together, and the trend across all of them is what tells you whether the programme is working. Our guide to phishing simulation click rates covers how to read those numbers without fooling yourself.
Sequencing a year of simulations and training
The most common mistake in programme design is treating simulations and courses as two separate calendars owned by two different people, they work far better interleaved.
A workable pattern for a full year looks like this, start with the baseline simulation and follow it within days with the core training module, so the connection between the test and the learning is obvious. Alternate from there, a simulation every four to six weeks per user, with short reinforcement content in the gaps, raising simulation difficulty gradually and rotating scenario types so nobody is being tested on the same instinct twice.
Mapping that in advance rather than deciding month by month saves an enormous amount of administration and produces much better coverage. Boxphish customers usually build the first year during onboarding using the journey builder, which schedules simulations and courses on a single calendar up to a year ahead, then runs without further intervention.
Timing around the organisation's own calendar helps too. Avoid year end in finance, admissions periods in education and the first week of a major system rollout, not because those are bad times to test but because the results will reflect the workload rather than the awareness.
The click is the teachable moment
The few seconds after someone interacts with a simulation are the most valuable in the entire programme. The person is attentive, mildly embarrassed and thinking about the specific email in front of them, which is a far better learning state than a scheduled course in a quiet week.
The landing page should be short and calm, explaining what the message was and pointing to the two or three signals that gave it away in that specific email. The follow-up module should arrive the same day and take minutes rather than an hour. Anything longer reads as punishment, and punishment is what turns a training programme into a trust problem.
Reporting is the bridge between the two
If simulations are the assessment and training is the intervention, reporting is what connects both to real security operations. A workforce that reports quickly gives your security team the chance to pull a live phishing campaign from every inbox before it does damage, and that capability is built by the simulation programme whether or not anyone clicks.
Make the action easy, in-inbox reporting means one click from the message itself rather than a form on an intranet page nobody can find. Make the response positive, so the service desk thanks people rather than sighing, including for the false alarms, because a workforce that only reports when it is certain reports far too late.
Delivering training where people already work helps as well. Boxphish integrates with Microsoft 365 for user syncing and single sign-on, and with Microsoft Teams so courses can be assigned and completed inside Teams rather than in yet another system, which consistently lifts completion rates.
Who owns which part
Programmes stall when ownership is vague, IT or security usually owns the platform, the simulation calendar and the technical configuration. HR owns the policy position, the disciplinary stance and induction. Internal communications owns the announcement and the ongoing story. Line managers own the follow-up conversations with people who are repeatedly caught, since those are almost always about workload and process rather than awareness.
Agree the disciplinary position before the first send, our guide to whether to tell employees about phishing simulations covers the consultation and disclosure side, which is worth settling early rather than in the middle of a complaint.
Measuring the programme rather than the campaign
Campaign metrics answer whether one send went well, programme metrics answer whether the organisation is safer and boards care about the second.
Three things belong in that view: The behavioural trend, - meaning click and report rates against a template held at consistent difficulty across the year, the coverage picture - meaning who has completed what (including new starters and the people who never seem to be available) and the risk concentration - meaning which teams or roles remain the most likely entry point, which is where the next round of effort goes.
The Boxphish figure worth holding onto here is the gap the programme is closing. Analysis of more than 400,000 users found untrained users are 8.8 times more likely to click a phishing email than trained users, which is the difference between the two ends of a well run cycle.
Where this leads next
Once simulations and training run together reliably, most organisations start asking a bigger question, which is whether behaviour across the whole organisation is changing rather than whether one exercise went well. That is the ground covered by security behaviour and culture programmes, and we compare the two approaches in security awareness training versus security behaviour and culture programmes.
The starting point does not change though. You cannot manage behaviour you have never measured, and a simulation programme is still the most practical way to measure it.
Frequently asked questions
Should phishing simulations come before or after training?
Run a baseline simulation first so you know where you are starting, then deliver training, then keep alternating. The baseline is only clean once.
How many simulations should a training programme include?
Most organisations reach each user every four to six weeks, which works out at roughly ten to twelve simulations a year with reinforcement content in between.
Do simulations count towards compliance training requirements?
They usually support rather than replace them. Frameworks and insurers tend to ask for evidence of both awareness activity and its effect, and simulation data is the strongest evidence of effect you can offer.
What should happen to staff who repeatedly click?
Treat it as a workload and process question first. Repeat interaction often traces back to roles that handle unexpected external mail all day, where the fix is a process change rather than another module.
Can training be delivered inside Microsoft Teams?
Yes. Boxphish delivers courses natively in Microsoft Teams, with sign in handled by the Microsoft account, which typically improves completion rates compared with email only delivery.
If you want the simulation and training calendar built for you rather than assembled month by month, that is part of Boxphish onboarding. Book a demo, or read more about cyber security awareness training and phishing simulations.
