The short answer
Yes, run them. The Canadian Centre for Cyber Security recommends internal phishing simulations so staff understand the risks safely, alongside clear procedures for verifying and reporting suspicious messages (Cyber Centre). They help only if behaviour changes: realistic scenarios, one-click reporting with quick feedback, coaching rather than blame, and metrics that track reporting, not only clicks.
Why the click rate misleads
A falling click rate may be progress, or easier templates, staff who recognize the test sender, people ignoring unknown senders (customers included) or a group-chat warning whenever a test lands. Meanwhile the habit that protects you most, reporting quickly, may not have improved. One early report of a real phish lets security remove it from every inbox before others click: worth far more than a low click rate.
Design scenarios that teach something
Supplier invoices
Invoice and banking change requests, for finance and accounts payable.
Shared documents
Document and e-signature notices that mimic tools staff use daily.
Deliveries
Courier notices, for operations and reception.
Executive requests
Gift cards or urgent transfers, aimed at assistants and managers.
MFA and password prompts
Teach staff never to approve a prompt they did not start.
QR codes and texts
Attackers increasingly move outside email.
Vary difficulty from many warning signs to few. Each scenario needs a one-sentence teaching point on its landing page.
Ground rules that keep staff on side
Simulations are workplace monitoring; handled badly, they breed resentment. Our rules:
Announce the program
Say simulations will happen, why and how results are used (not each test).
No public shaming
And no league tables of individuals.
No cruel lures
No fake bonuses, layoffs, health scares or tragedies; they damage trust.
Coach privately
A short, friendly explanation, not a note to the manager.
Thank reporters
Automatic thanks; occasional recognition for teams that report well.
Protect the results
Employee personal information: limit access and retention.
Include leadership and IT: exempting them sends the wrong message and leaves high-value targets untested.
Rather talk it through? If your current simulations produce reports but no real change, we can redesign them around reporting and coaching. Talk to a Promatics specialist
Metrics that show real change
NIST guidance asks learning programs to encourage behaviour change and use metrics to improve (NIST SP 800-50 Rev. 1). Track these over time by department and scenario type, not by individual.
| Metric | What it tells you |
|---|---|
| Report rate | Share who reported the message |
| Time to first report | How fast the first alarm was raised |
| Click rate | Share who clicked a link or opened an attachment |
| Credential entry rate | Share who went on to enter a password |
| Repeat clicks | Who needs more support, handled privately |
| Real phishing reports | Whether the habit carries over to real attacks |
Strongest signal: report rate up, time to first report down, more real suspicious messages reported to IT.
Make reporting easy and worthwhile
Reporting must take seconds: a report button, an automatic acknowledgement and someone who actually reviews reports. Staff who report a real attack and hear nothing stop reporting. Technical controls matter as much: filtering, SPF, DKIM, DMARC and MFA reduce what reaches people and limit damage. Our email security service covers that side.
What usually goes wrong
- Gotcha culture: results go to managers, people are embarrassed, staff stop trusting IT.
- One template for everyone: finance never sees an invoice lure; the warehouse gets an executive memo.
- Annual tests only: they measure little and teach less.
- No closing of the loop: reports land in a mailbox nobody reads.
Programme checklist
- Programme announced to staff, with purpose and data handling explained
- Report button deployed and reported messages reviewed
- Scenarios mapped to roles and real threats
- Difficulty varied over the year
- Landing pages explain the teaching point
- Private, coaching-based follow-up for clicks
- Leadership and IT included
- Report rate and time to first report tracked
- Access to individual results restricted; retention period set
When to bring in help
Built-in email platform tools can run basic simulations. A professional pays off for scenarios fitted to your suppliers and systems, results that need careful employee-relations handling, or links to real incident handling so reported messages are investigated and removed fast. An AI assistant writes a convincing lure in seconds; it cannot judge which lures are fair for your workforce, run the program monthly, respond to a real report or tell leadership honestly what changed.
Our cybersecurity awareness training combines short lessons, realistic simulations and reporting that shows whether behaviour improves. For the wider program, see building a security awareness training program that changes behaviour.
Limitations
General guidance, not legal advice. Employee monitoring and privacy expectations differ by province, sector and workplace: involve HR, and legal counsel where appropriate, before launching.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Don't take the bait: Recognize and avoid phishing attacks (ITSAP.00.101), Canadian Centre for Cyber Security
- NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, National Institute of Standards and Technology
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.