SecurityRingBook a Demo

Glossary

What is a phishing simulation?

A safe, realistic phishing message sent to employees by their own organisation, so they can practise spotting and reporting attacks and the organisation can measure the response.

How it works

An organisation sends a controlled message that imitates a real attack. The system records who clicked or submitted data, and those who act on it are usually shown training. NIST SP 800-50 Rev. 1 (2024) covers building an awareness and training programme, including metrics and evaluation to improve it over time.

A real example

The UK NCSC’s phishing guidance is candid about the limits: no training package, including phishing simulations, can teach users to spot every phishing attempt. It warns that simulations can erode trust and create legal risk, advises checking with HR first, and suggests measuring reports, not just clicks.

How to run one well

  • Make it a learning moment, never a punishment.
  • Use scenarios that match real threats to your teams.
  • Measure reporting alongside clicks, and track the trend.

SecurityRing’s phishing simulation sends anyone who acts on a simulation straight to a short lesson on that exact email. Across 100+ SecurityRing campaigns that have trained 10,000+ people, more than half of the people who clicked completed the in-the-moment lesson without a reminder.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. UK National Cyber Security CentrePhishing attacks: defending your organisationAccessed 17 October 2026.
  2. NISTSP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning ProgramPublished 26 September 2024 · Accessed 17 October 2026.