What is a phishing simulation?
A phishing simulation is a test under everyday conditions: employees receive a prepared message without warning and decide whether to click, ignore or report it. For entities under the German BSI Act, basic training and awareness measures in information security are among the minimum measures of § 30(2) no. 7 BSIG. A simulation is one such awareness measure and belongs in a security awareness programme.
How does a phishing simulation differ from training?
Training conveys knowledge; a phishing simulation tests a reaction under time pressure: between two meetings, with a full inbox, without notice of the individual wave. Without basic training and a known reporting channel, the simulation remains a test with nothing to learn from. The guide to ISMS implementation shows how both are anchored in the management system.
A simulation does not assess people. It measures how the organisation responds to a lure; a single click is no verdict on the person who made it.
Reporting rate over click rate
The meaningful metrics of a phishing simulation are the reporting rate and the time to the first report. In a real attack a single click can be enough. The time to the first report, by contrast, decides whether the security team can react while the attack is running.
Track the click rate as a secondary figure only. The metric shapes the message to staff: reporting is what counts, not being error-free. The page on incident response describes how a report moves into incident handling.
Does the works council have to agree to a phishing simulation?
The works council may have a right of co-determination over a phishing simulation. Under § 87(1) no. 6 of the Works Constitution Act (BetrVG), it co-determines the introduction and use of technical devices designed to monitor employee behaviour or performance. Whether a simulation falls under it depends on what data the tool collects and whether it can attribute clicks to individuals. An employment law review settles this in the specific case.
If no agreement is reached, the conciliation board decides under § 87(2) BetrVG. Involve the works council before the first campaign, and set out purpose, depth of analysis, retention period and the exclusion of individual sanctions in writing.
Data protection: analyse in aggregate, not per person
A phishing simulation processes data about employee behaviour and is therefore subject to data protection law. Purpose, legal basis, scope of the data collected, retention period, access rights and the use of external providers all need settling. The data protection officer belongs in the process from the start.
Limit the analysis in advance:
- analysis at the level of the organisation or larger units,
- no rankings of individuals or small teams,
- no employment consequences from a click,
- a short, fixed retention period for raw data,
- feedback directly after the click that explains how the message could have been recognised.
A campaign in five phases
A campaign runs in five phases; the legal review comes at the start, not in the follow-up.
| Phase | What happens | Who is involved |
|---|---|---|
| 1 Set the frame | Put purpose, data collected, depth of analysis, retention period and the exclusion of individual consequences in writing | Data protection officer, works council, legal counsel |
| 2 Prepare | Choose scenario and difficulty, agree the reporting channel with the service desk, announce the programme as such | Security team, service desk, communications |
| 3 Run | Spread sending across the day, give feedback immediately after a click | Security team |
| 4 Analyse | Reporting rate and time to first report as main figures, click rate as a supplement, analysis in aggregate | Security team, data protection officer |
| 5 Follow up | Turn findings into measures with an owner and a deadline, delete raw data on schedule | Security team, business units |
Phase 5 decides the value: a campaign whose result triggers no task with an owner repeats the same measurement next year.
Which lures should a phishing simulation avoid?
A phishing simulation should avoid lures that exploit personal concerns: salary, bonus, dismissal, health or bereavement. Such lures cost the trust that willingness to report depends on. Three rules apply to all other lures:
- Raise the difficulty over time instead of starting with a lure that is barely recognisable.
- Spread campaigns across the year instead of bundling them.
- Announce the programme, not the individual wave.