1 November 2026 · 12 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
How to run a phishing simulation campaign: a 10-step playbook for an authorised internal test, from mandate to board report
A phishing campaign run against your own organisation is one of the few security tests whose main risk is not technical but human: get the ethics, the legal basis or the follow-up wrong and you lose the trust that makes people report. This guide sets out the decisions and controls, in order, for an organisation planning its own campaign, and where a managed service makes more sense.
What an internal phishing campaign is, and the rule that governs it
An internal phishing campaign, or phishing simulation campaign, is an authorised exercise in which an organisation sends realistic but harmless phishing lures to its own employees to measure how they respond and to teach them in the moment. It is legal and appropriate only when the organisation itself commissions it, when its legal basis and employee-representation obligations are settled, and when the purpose is measurement and learning rather than discipline.
That last clause is the governing rule. Every design decision below, from the pretext to the landing page to the board slide, follows from it. A campaign built to catch people produces hidden clicks, resentment and a reporting rate that collapses. A campaign built to teach produces reports, and reports are the behaviour that stops real attacks. If the sponsor cannot sign up to that rule, do not run the campaign.
This guide is for the team that runs the campaign in-house, or that wants to understand what a managed provider should be doing on its behalf. For the training programme that surrounds the campaign, see our phishing training guide; for the phishing sub-types you may want to simulate, our free awareness library explains each one.
Before you send anything: mandate, legal basis, HR and the works council
Most campaign failures are decided before the first email. Settle these in writing.
- A written mandate from an executive sponsor naming the objective, the population in scope, the period, who may see individual results and who may not.
- A legal basis under the GDPR, normally legitimate interest (Article 6(1)(f)) documented in a balancing test, and a data protection impact assessment where the campaign systematically monitors employee behaviour (Article 35). Record events (delivered, clicked, reported), never message content or passwords, and set a retention period measured in months.
- Works council consent where required. In the Netherlands, Article 27(1)(l) of the Works Councils Act (Wet op de ondernemingsraden) gives the works council a right of consent on arrangements aimed at or suitable for monitoring the presence, behaviour or performance of employees; a campaign that records who clicked falls within it.
- An HR agreement that results are never recorded in personnel files, never used in appraisals or disciplinary processes, and that repeat clickers receive coaching, not sanctions. Publish this agreement to staff before the programme starts.
- A communications plan: announce the programme (not the individual campaigns), explain the purpose, show the report button, and name the contact for questions.
- Briefings for the service desk and, depending on the objective, the SOC or MDR provider. If detection is also under test, inform the SOC afterwards, and make sure someone with authority can stand them down if the campaign is mistaken for a real attack.
- Exclusions: employees on leave, new joiners in their first days, people in an active HR process, and external contractors unless their contract and legal basis cover them.
Prefer to have the campaign run for you?
The 10 steps of a phishing simulation campaign
In order. Skipping a step rarely saves time; it usually costs a later campaign.
1. Define the objective and the metric
Decide what the campaign is for: a baseline, a measure of a specific group, a test of the reporting path, or a check on detection. Write down the metric that answers it (report rate, time to first report, credential submissions) before you choose a lure.
2. Secure the mandate and the legal groundwork
Everything in the checklist above, signed, including the agreement with HR and the works council on how results are aggregated and who sees what.
3. Run a baseline
The first campaign measures where you start. Use a medium-difficulty lure representative of what your sector actually receives, send to a statistically meaningful sample or the whole population, and resist the urge to train first. You need the untreated number.
4. Choose scope and segmentation
Decide whether to send to everyone at once, by department, or in waves. Waves reduce the chance that one person warns the whole office in the first five minutes and spoils the measurement. Segment results by role, never by individual, in any report that leaves the security team.
5. Design the pretext within the ethical boundary
The pretext is the story the lure tells. It should mirror what attackers actually use against organisations like yours: a shared document, a password-expiry notice, a parcel, a vendor invoice, a Teams message, a voicemail notification. The section on pretext ethics below sets the limits.
6. Set the difficulty level
Decide how many cues you leave for the recipient to spot, and record the level with the results. Difficulty is the variable that makes click rates comparable across campaigns.
7. Build the landing page and the teaching moment
What happens after the click decides whether the campaign teaches or merely counts. Design the page before the lure.
8. Prepare the sending infrastructure and allow-listing
At concept level: a sending domain the organisation controls, mail authentication aligned so you test people rather than filters, a documented and time-bound exception in the secure email gateway, and tracking that separates human clicks from security tools that open links automatically.
9. Launch, monitor, triage
Send in the agreed window, watch the report queue in real time, answer reporters promptly, and be ready to stop the campaign if anything unexpected happens, such as a real campaign landing at the same time.
10. Measure, report, iterate
Compare against the baseline at the same difficulty, write the board report, turn the lures that worked into next quarter's training content, and schedule the next campaign. One campaign is a data point; a programme is a trend.
Difficulty levels: from obvious to targeted
Record the level with every campaign. A click rate without a difficulty level is a number without a denominator.
Level 1: generic
A broad lure with several cues left in: an unfamiliar sender, a generic greeting, a vague request, a link to an unrelated domain. Useful for onboarding cohorts and as a floor measurement. Most organisations should move past it within two campaigns.
Level 2: branded
A convincing imitation of a service the organisation actually uses: a document-sharing notification, a password-expiry notice, a parcel-tracking message. Correct logos, plausible sender name, one or two cues remaining (the link domain, the timing). The workhorse level for most quarterly campaigns.
Level 3: contextual
Built on public information about the organisation: a project named in a press release, a conference the team attends, a vendor listed on the website, the annual customer event. Few cues remain; this level tests verification habits rather than recognition.
Level 4: targeted (spear phishing)
Aimed at a named role or small group, referencing real colleagues or live work, sometimes combined with a phone call or a text message. Realistic for executives, finance and administrators, and only with explicit sponsor sign-off and consent from anyone impersonated. Our awareness module on spear phishing explains the attacker's side; this level reproduces it under control.
Pretext ethics: what you may use, and what you may never use
A pretext is acceptable when it mirrors a real threat and when being deceived by it costs the recipient nothing but a lesson. IT notices, document shares, vendor invoices, delivery notifications, calendar invitations, Teams or Slack messages, MFA prompts and customer enquiries all pass that test. Imitating a real external brand is common practice, but keep the imitation generic enough to avoid trademark complaints and never host it on a domain that could be mistaken for the brand's own.
Some pretexts fail the test however realistic they are, because the deception itself causes harm. Do not use bonuses, pay rises, salary changes, redundancies, reorganisations or layoffs. Do not use health, bereavement, family emergencies, disasters or charity appeals. Do not impersonate the works council, the confidential counsellor, HR in a confidential capacity, or occupational health. Do not impersonate the police, the tax authority or other public bodies, which carries legal risk of its own. Several organisations have learned this in public: campaigns promising bonuses during a pay freeze made headlines and cost the security team its credibility.
Impersonating a real colleague requires that colleague's consent, in writing, before the campaign. Impersonating a real supplier requires at minimum that the supplier is informed afterwards. When in doubt, ask whether you would be comfortable explaining the pretext to the works council, the privacy officer and the employee who fell for it, all in the same meeting.
The landing page and the teaching moment
The landing page is where the campaign earns its keep. By default it should record the click and nothing more; if credential submission is in scope, the page records that something was submitted and discards the input immediately, never storing or transmitting the password. The page should work on mobile, in every language the workforce uses, and within the organisation's accessibility standards.
The teaching moment is the content shown the instant someone clicks or submits: a clear statement that this was an authorised simulation, the two or three cues that would have given it away (marked on a screenshot of the actual lure), a 60-second explanation of what the real version would have done, and the report button with an invitation to use it next time. The tone is matter-of-fact and respectful: no countdown timers, no red warning banners, no 'you have been phished' in capitals. The recipient should leave knowing what to look for and feeling that reporting is the expected next move, not that they have been caught.
Link the teaching moment to a short module rather than a 40-minute course. The phishing modules in our free awareness library are built for exactly this use: one technique, one page, one assessment, no login.
Sending infrastructure and allow-listing, at concept level
A simulation that is stopped by your own mail filter measures the filter, not the people. Unless filter testing is the stated objective, the mail must arrive, which means a few infrastructure decisions have to be made deliberately rather than by trial and error.
Use sending domains the organisation or its provider owns and controls, with mail authentication (SPF, DKIM and DMARC) configured so the messages are delivered on their own merits rather than through broad filter exceptions. Where the secure email gateway still needs an exception, make it specific (a header, a sending address range), time-bound to the campaign window, documented in the change record and removed afterwards. A permanent allow-list for a simulation domain is a real vulnerability waiting for a real attacker to find it.
Account for automated link visitors. Security tools that pre-fetch or sandbox links register as clicks and inflate the result; use tracking that distinguishes an employee's browser from a scanner, and reconcile against the gateway logs. Add an identifying header so the SOC can recognise simulation traffic in hindsight.
What to measure, per campaign and across the year
Click rate is the number everyone asks for and the least informative on its own. Report these together, always with the difficulty level attached.
- Report rate: the share of recipients who reported the lure, whether or not they clicked. This is the behaviour the programme exists to build.
- Time to first report: minutes from delivery to the first report. It tells you whether the SOC could have contained a real campaign.
- Click rate, read against difficulty level and compared only with campaigns at the same level.
- Credential submission rate, where in scope: the true impact metric, because a click is noise and a submitted password is an incident.
- Repeat clickers across campaigns, held within the security team as a coaching list, never as a disciplinary one.
- Programme metrics: campaigns per year, share of staff who received a teaching moment, and the trend of report rate over four or more campaigns.
Reporting to the board
Board members do not need a dashboard of clicks. They need one page: what was tested, at what difficulty, what the report rate and time to first report were, how both trend against the baseline and the previous campaign, which groups need attention and what the programme will do next quarter. Present aggregates only. Name no individuals. Translate the metrics into risk language: 'the first report arrived four minutes after delivery, so a real campaign of this type would have reached the SOC before most recipients had opened it'.
Under NIS2, Article 20 makes management bodies responsible for approving and overseeing cybersecurity risk-management measures and obliges them to follow training themselves. A phishing programme report is one of the few recurring security artefacts a board can read without translation, which makes it a useful anchor for that oversight. DORA's Article 13(6) training obligation for financial entities, including senior management, can be evidenced the same way.
What not to do
Each of these has ended a programme somewhere. Agree them in writing with HR before the first campaign.
- No shaming: no public lists, no team league tables that identify individuals, no 'wall of shame', no mentioning clickers in all-hands meetings.
- No bonus, pay rise, salary, redundancy, reorganisation or layoff pretexts, and no health, bereavement, disaster or charity pretexts.
- No results in personnel files, appraisals or disciplinary processes, and no sanctions for clicking.
- No impersonation of real colleagues without their written consent, and no impersonation of the works council, confidential counsellor, occupational health, police or public authorities.
- No campaigns during an ongoing incident, a reorganisation, a merger announcement or another period of genuine stress, when a lure is most likely to be misread as real.
- No sending outside working hours to personal devices or private numbers; proportionality under the GDPR and basic respect both argue against it.
- No permanent allow-list for the simulation domain in the mail gateway, and no credential storage on the landing page, ever.
In-house versus managed phishing campaigns
Both routes can work. The difference is where the effort and the realism come from.
| Aspect | In-house campaign | Managed campaign |
|---|---|---|
| Tooling | A platform licence or an open-source simulation framework, operated by your team | Provider's infrastructure, maintained and authenticated by them |
| Pretext quality | Depends on who writes them and how closely they follow current attacker techniques | Built from the lures the provider sees in live engagements and threat intelligence |
| Legal, HR and works council groundwork | Yours to do either way; a platform does not do it for you | Yours to approve; the provider brings templates for the mandate, DPIA and works council request |
| Allow-listing and deliverability | Your mail team's time, and a standing risk if exceptions are left in place | Provider's domains and authentication; exceptions scoped and removed by agreement |
| Difficulty range | Levels 1 and 2 reliably; levels 3 and 4 need research time your team may not have | All four levels, including vishing, smishing and QR variants, with threat intelligence behind the targeted ones |
| Teaching moment | Platform templates, customised by you | Written for your organisation and linked to your training content |
| Reporting | Platform dashboards; the board narrative is yours to write | Board-ready report, benchmark in words, and a debrief with the sponsor |
| Cost logic | Per-user licence plus internal time, growing with headcount | Per campaign or per programme, scoped to the objective; see our phishing simulation cost guide |
| Best for | Organisations with a mature security team, a dedicated owner and a stable platform | Organisations that want realism and board-level reporting without building the capability in-house |
How HackersHub runs managed phishing campaigns
HackersHub runs phishing simulation as a managed engagement. Our testers scope the campaign with your sponsor, legal and HR, bring the mandate and works council templates, design pretexts from the tradecraft we encounter in live red team operations, operate our own authenticated sending infrastructure, build the teaching moment around your reporting process and deliver a report written for the board. Vishing, smishing and QR variants are available where the objective calls for them. Every engagement is scoped individually; there is no price list.
If you run your own programme and want an independent calibration, a single managed campaign at level 3 or 4 against your most exposed roles is a common starting point. Talk to a practitioner about what your objective needs.
Frequently asked questions
Related guides and resources
- Phishing simulation services by HackersHub
- Phishing training for employees: what works and how to run it
- Security awareness training: how to build a programme
- Phishing simulation cost: pricing models and cost drivers
- Free security awareness library (no paywall)
- Awareness module: spear phishing
- Awareness module: business email compromise
- Social engineering testing: vishing, pretexting and on-site
Want the campaign run by people who see real phishing every week?
HackersHub scopes, authorises and runs phishing simulation campaigns together with your legal and HR teams, builds the teaching moment into every click and reports to your board. Schedule a call.