Advanced level · Module 5: Data Protection, Ethics and Security Culture · Lesson 4 of 4
Ethical Phishing Simulations
Use simulations to teach, not to trap or shame.
In this lesson you will
- Plan an ethical phishing simulation
- Use results to support learning
Key concepts
approval and transparencyrealistic but fair luresteachable momentsno blame
The lesson
Simulations need leadership approval, a policy that staff are told about in general terms and agreed limits — for example, no lures about salaries, health or bonuses that cause distress.
When someone clicks, show a short teaching page rather than punishing them. Track trends across the organisation, not league tables of individuals.
Measure reporting rates as well as click rates: a rising number of reports is a sign of success.
Step by step
- Draft simulation rules.
- Design two fair lures.
- Write the teaching page.
- Choose the measures.
Practice activity
Write the phishing simulation plan for the awareness programme.
Expected result: An ethical, approved plan with teaching and measures.
Check your understanding
-
What should happen when someone clicks a simulated phish?
Show answer
They see a short teaching page; they are not punished.
-
Why measure reporting rates?
Show answer
Rising reports show staff are acting correctly.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.