Phishing Simulation for Employees
A phishing simulation measures click behaviour, credential submission and reporting behaviour among employees; the report follows within 5 business days.
What is tested and why it matters
Measuring whether security awareness training changes behaviour under realistic conditions.
Phishing remains the most common initial access vector in confirmed breaches. Security awareness training teaches employees what phishing looks like. A phishing simulation measures whether that training changes behaviour under realistic conditions. The assessment sends controlled phishing emails using pretexts tailored to the organisation, then measures who clicks, who submits credentials, and who reports the email through the correct channel. The result is data, not assumptions, about the organisation security awareness posture.
Who needs this assessment
Organisations that benefit most.
This assessment is designed for organisations that want to measure employee security awareness with data rather than assumptions or self-reported surveys.
Organisations that want to measure employee security awareness with data rather than self-reported surveys
Companies in regulated industries where security awareness testing is a compliance requirement
Organisations that have conducted security awareness training and want to validate its effectiveness
Companies that have experienced phishing incidents and want to identify the remaining awareness gaps
Organisations combining phishing simulation with scenario-based pentests for multi-vector assessment
Healthcare and government organisations required to demonstrate staff security awareness under regulatory compliance obligations
Where advanced testing is applicable
- Financial services: adversary simulation testing detection and response across trading and banking platforms.
- Critical infrastructure: scenario-based assessments validating incident response for essential entities.
- Corporate environments: physical access testing and phishing simulations measuring employee awareness.
- Organisations with a SOC or incident response team seeking realistic validation of detection capabilities.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering campaign statistics, susceptibility analysis by department, reporting behaviour data, and targeted recommendations. Reports are delivered through the Pentrox Portal and are available for download at any time.
- Precise click rate, credential submission rate, and reporting rate data across the organisation
- Identification of departments, roles, or user groups with the highest susceptibility
- Assessment of whether existing security awareness training translates into changed behaviour
- Recommendations for targeted awareness improvements based on measured gaps
- Portal access with campaign results, report downloads, and project tracking for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from campaign design through awareness recommendations.
Each phase builds on the previous one. Campaign design defines the pretexts, execution measures behaviour, and reporting analysis drives the targeted awareness recommendations.
Campaign design and scoping
The campaign is designed with the client. Target groups, timing, and wave count are agreed. Pretexts are tailored using industry-specific scenarios.
NIST SP 800-61 (Preparation), Social Engineering Framework (Campaign Planning)Pretext development and infrastructure
Custom phishing emails and landing pages are developed per wave. Emails mimic password resets, document sharing, or IT requests. Each interaction is tracked.
MITRE ATT&CK T1566 (Phishing), Social Engineering Framework (Pretext Design)Campaign execution
Phishing emails are sent to agreed target groups. Each interaction is tracked: email opens, link clicks, credential submissions, and attachment opens.
MITRE ATT&CK T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link)Reporting behaviour analysis
Reporting behaviour is analysed alongside click rates. Correct-channel reports, response times, and whether incident response was triggered are documented.
NIST SP 800-61 (Detection and Analysis), Social Engineering Framework (Metrics)Reporting and awareness recommendations
Findings are validated by a second reviewer. The report covers campaign statistics, department breakdown, wave comparison, and awareness recommendations.
PTES (Reporting), NIST SP 800-61 (Post-Incident Activity)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact target groups, campaign waves, and metrics before the assessment begins. The lists below reflect the standard scope.
In scope
- Custom phishing email campaigns tailored to the organisation
- Credential harvesting via controlled landing pages (where agreed)
- Click rate, credential submission rate, and reporting rate measurement
- Multiple campaign waves with different pretexts and difficulty levels
- Spear phishing targeting specific roles or departments (where agreed)
- Employee reporting behaviour analysis
- Breakdown of results by department, role, or user group
Out of scope
- SMS-based phishing (smishing) unless explicitly agreed during scoping
- Physical social engineering (covered under Mystery Guest)
- Exploitation of vulnerabilities on employee devices or the email platform
- Ongoing awareness training delivery (recommendations provided for the client training programme)
What you receive
- Executive summary Overall click rate, submission rate, and reporting rate written for leadership.
- Campaign statistics Breakdown by department, role group, and campaign wave with comparison data.
- Wave comparison Susceptibility analysis by pretext type and difficulty level across campaign waves.
- Reporting behaviour analysis Correct-channel reporting rates, response times, and incident response trigger assessment.
- Portal access Campaign results, report downloads, and project tracking through a dedicated platform.
- Findings meeting A scheduled session to review results and align on awareness improvement priorities.
- Management report Condensed report for board-level stakeholders covering campaign outcomes and recommendations.
Read more
How to choose your ethical hackers
Seven questions that reveal who will really test your systems.
What to expect during your first penetration test
The five stages from scoping to retest and what each asks of your team.
What a penetration test costs
Indicative prices by service, what moves the number, and what the price includes.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a phishing simulation depends on the number of campaign waves, the size of the target group, and whether the assessment is standalone or combined with a broader multi-vector assessment. The calibration bands below are indicative.
What determines duration
- Number of campaign waves and pretext variations
- Size of the target group and number of departments included
- Whether credential harvesting landing pages are included
- Whether the campaign is standalone or combined with a scenario-based pentest
- Whether spear phishing targeting specific individuals is included
Actual duration is confirmed during scoping and depends on campaign complexity and target group size. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after the campaign concludes.
Why Pentrox
The operational standards behind every phishing simulation.
These operational standards apply to every phishing simulation Pentrox delivers, regardless of scope or campaign complexity.
Custom campaign design
Pretexts tailored to the organisation, not generic templates.
Each campaign is designed for the target organisation. Pretexts use industry-relevant scenarios and internal communication styles to create realistic emails that test actual employee decision-making under pressure.
No public shaming of individuals
The report identifies systemic gaps, not individual employees.
Individual employees are not named. Results are aggregated by department, role group, or campaign wave. The objective is to identify systemic awareness gaps and measure training effectiveness.
Reporting behaviour measurement
Measuring who reports phishing is as important as measuring who clicks.
The assessment tracks correct-channel reporting alongside clicks and credential submissions. A high click rate with high reporting indicates a different risk profile than one with no reports.
Senior-led testing
Every assessment is performed or supervised by experienced ethical hackers.
Pentrox does not delegate assessments to junior testers. Team members hold industry-standard certifications (OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES, BSCP) and every report passes internal quality review.
Portal-delivered results
Campaign results and findings accessible in the Pentrox Portal.
Phishing simulation findings are published in the Pentrox Portal alongside any technical assessment findings. The client team can review statistics, track improvement, and download reports.
Frequently asked questions
Practical answers for security teams and procurement officers.
Are individual employees named in the report?
Individual employees are not named. Results are reported by department, role group, or campaign wave. The objective is to identify systemic awareness gaps, not to attribute blame to specific individuals.
Which standards does the assessment follow?
The assessment is aligned with NIST SP 800-61 for incident response measurement, the Social Engineering Framework for campaign design and human factor analysis, and PTES for structured testing methodology. MITRE ATT&CK T1566 is used for phishing technique classification.
Can the assessment be combined with other services?
Phishing simulations can be combined with scenario-based pentests or red team assessments. Credentials obtained through the phishing campaign can serve as the initial access vector in a broader technical assessment, testing the full chain from social engineering through network compromise.
What happens to credentials captured during the campaign?
All credentials captured during the campaign are stored securely and deleted after reporting. Credentials are used only to measure submission rates and are not retained beyond the assessment period. The handling of captured credentials is agreed during scoping.
Can multiple campaign waves be executed?
Multiple waves with different pretexts and difficulty levels can be executed within a single assessment. This provides comparison data across different phishing scenarios and identifies which pretext types the organisation is most susceptible to.
How is production impact managed?
Phishing emails are sent according to the agreed schedule and do not disrupt email infrastructure. Landing pages are controlled by Pentrox and do not interact with client systems beyond capturing form submissions. Campaign timing avoids critical business periods when agreed during scoping.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
Is the report delivered in Dutch or English?
Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.
How often should a phishing test be run?
One campaign gives a baseline. The effect of training only shows in a second and third wave. Most organisations run two to four waves a year, each with a different pretext and a higher difficulty, so the reporting rate and the click rate can be compared over time.
What is needed to set up a phishing campaign?
A list of e-mail addresses for the target group, one contact person for coordination and approval from management. Pentrox arranges the rest: the sending domain, the e-mails, the landing page and the measurement. Your IT team only allowlists the sending domain so the e-mails are delivered.
Related assessment categories
Scenario-Based Pentest
A predefined attack scenario executed to validate whether a specific attack path can reach critical assets.
Red Teaming
Full-scope adversary simulation across network, application, social engineering, and physical vectors.
Mystery Guest
Controlled physical access testing through social engineering and physical security exploitation.