Phishing Simulations
Practise Spotting Phishing Before It Counts
Many cyber attacks start with a convincing email. Pulsar IT runs realistic, safe phishing simulations, agreed with you in advance, so your team can practise spotting and reporting suspicious messages without any real risk.
What is Phishing Simulations?
Phishing is when criminals send emails, and sometimes texts or messages, that pretend to come from someone you trust. The aim is to trick staff into clicking a link, opening an attachment, entering a password or paying a fake invoice. Email filtering stops many of these messages, but some still get through.
A phishing simulation is a safe, realistic practice email that we send to your staff with your agreement. It looks like the kind of message a criminal might send, but any link leads to a harmless page that explains what to look out for. Nothing is installed, and test pages are designed so that real passwords are not collected.
Over a series of campaigns you can see how many people clicked, how many reported the message and how that changes over time. Staff who would benefit from extra support get short, practical follow-up guidance, not a telling-off.
Key benefits
- Staff practise on realistic examples in a safe setting
- Every campaign planned and agreed with you before anything is sent
- Clear reporting on clicks, reports and trends over time
- Supportive follow-up for anyone who needs it, with no naming and shaming
- A record of awareness activity you can share with your board, clients or insurer
How does it work?
Each campaign is planned with you, sent to agreed staff, then measured and followed up. The aim is to build good habits, especially reporting, rather than to catch people out.
Agree the plan
With a nominated contact, we agree which staff are included, the scenarios, timing and frequency, and who in your business knows a campaign is running, so a real incident isn't mistaken for a test or the other way round.
Prepare safely
We set up the simulated emails and landing pages, and work with you so your email filtering lets the test messages through (known as allow-listing) for the campaign.
Send and measure
The campaign runs over the agreed period. We record link clicks, reports of the email and, where a scenario includes a test form, whether it was submitted. Test forms are designed so that real passwords are not collected or stored.
Report and follow up
You receive a plain-English report with trends and recommendations, and staff who clicked are offered short, supportive guidance on the warning signs they missed.
- Agreed campaignScenarios, staff and timing approved by you
- Simulated emailRealistic but harmless test message
- Safe landing pageExplains the warning signs; designed not to collect real passwords
- Report and follow-upClick and reporting trends, plus supportive guidance
What a campaign can include
- Scenarios based on common real-world lures, such as delivery notices, shared documents, invoice requests and password expiry warnings
- Difficulty that builds over time, from obvious warning signs to more convincing messages
- Landing pages that explain the warning signs straight after a click
- Sign-in style test pages, where agreed, designed so that real passwords are not collected or stored
- Tracking of link clicks and test-form submissions
- Measurement of how many staff report the email, and how quickly
- Allow-listing in your email filtering for the campaign, agreed with you
- Results summarised by team or department, with individual results shared only with agreed contacts
Typical scenarios
A fake supplier invoice
An email that appears to come from a supplier asking for an invoice to be paid to new bank details. It helps staff build the habit of checking payment changes by phone, using a number they already hold.
A shared document
A notification that a colleague has shared a file, leading to a sign-in style page. It teaches staff to spot look-alike addresses and unexpected sign-in prompts.
A missed delivery
A parcel notice with a tracking link. Familiar and convincing, it's a good starting point for checking where a link really goes before clicking.
An urgent request from a director
A message that appears to come from a senior colleague asking for a quick favour. It encourages staff to pause and check unusual requests, however senior the sender seems.
A Fair, Supportive Approach
Simulations only work if staff trust them. If people feel tricked or embarrassed, they hide mistakes, and in a real attack that costs valuable time. We design campaigns to encourage reporting and learning.
No naming and shaming
Results are used to target support, not to single people out. Individual results are shared only with the contacts you agree.
Sensible boundaries
We avoid themes that could cause real distress or confusion, such as pay, redundancies or health, unless you specifically agree otherwise.
Reporting is the goal
Spotting and reporting a suspicious email is the behaviour we want to see more of, so reporting rates are measured alongside clicks.
Honest about mistakes
Staff who click are shown what they missed straight away, so the lesson lands at the moment it is most useful.
We recommend telling staff that simulations will happen from time to time, without saying when or what they will look like.
Problems solved
Awareness fades between training sessions
A once-a-year course is quickly forgotten. Regular, realistic practice keeps the warning signs fresh.
Suspicious emails go unreported
If staff quietly delete a suspicious email, nobody else is warned. Simulations measure reporting and encourage it.
No idea where the risk sits
Without evidence it's hard to know which teams need more help. Campaign results show where to focus support.
Fake invoices and payment requests
Finance and admin teams are frequent targets of payment fraud emails. Targeted scenarios let them practise checking before paying.
Staff afraid to admit a mistake
Punitive approaches make people hide what happened. A supportive approach encourages staff to speak up quickly if they think they've clicked something real.
What's included
Included as standard
- Campaigns planned and agreed with you in advance
- Safe, realistic simulated phishing emails
- Landing pages that explain the warning signs after a click
- Reporting on clicks, reports and trends over time
- Follow-up guidance for staff who would benefit from it
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Security Awareness Training for all staff, as a separate service
- Targeted scenarios for finance, HR or senior staff
- Help setting up a simple way for staff to report suspicious emails
- A results summary for your board, clients or insurer
What's not included
- Any testing that hasn't been agreed with you in advance
- Collecting real passwords: test pages are designed so that they are not captured
- Phone call and text message simulations
- Disciplinary or HR decisions, which remain with your business
- Email platform licences or reporting add-ins, unless agreed in your proposal
Simulations show how people respond to particular messages on the day; they can't predict every real attack. Results are most useful as trends over several campaigns, alongside email filtering and other technical controls.
Some email security tools open links automatically to check them, which can register as a click. We account for this when setting up campaigns and reading the results.
Who it's suitable for
- Businesses whose staff handle invoices, payments or customer data by email
- Organisations that have had a phishing incident or near miss
- Teams that have completed awareness training and want to measure progress
- Businesses asked by clients or insurers about staff security awareness
- Growing teams with new starters joining regularly
Pricing
This service is tailored to your business, so we confirm the price after a short conversation about your requirements. There is no charge for the conversation.
Use the quote builder to add Phishing Simulations to an indicative quote, or book a free security review and we'll recommend what fits.
Price
On Application
Tailored price on application.
Included in the Advanced IT & Security plan (£35 per device per month).
What affects the price
- Number of users
- Campaign frequency
- Number and complexity of scenarios
- Reporting requirements
- Follow-up training requirements
- Email platform and delivery set-up
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Will staff be told in advance?
We recommend telling everyone that simulated phishing will happen from time to time, but not when or what it will look like. That keeps it fair and realistic. The exact approach is agreed with you.
Do the test pages collect real passwords?
They're designed not to. Sign-in style test pages record that a form was submitted and are built so that real passwords are not collected or stored. If someone did type a real password, we'd still suggest they change it as good practice.
What happens if someone clicks?
They see a short page explaining that this was a simulation and which warning signs they could have spotted. Anyone who would benefit gets follow-up guidance, and results are shared only with the contacts you agree.
How is this different from Security Awareness Training?
Training teaches the warning signs; simulations let staff practise them and show you how well the learning is sticking. They work best together. See Security Awareness Training.
How often should we run simulations?
Smaller, regular campaigns tend to build habits better than one large test a year. We agree a frequency that suits your team and goals, and adjust it as results improve.
Could a simulation disrupt our email?
Campaigns are planned with your nominated contact and whoever supports your IT, including allow-listing so messages are delivered and making sure reports are handled calmly. Test links lead only to harmless landing pages.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.