One ordinary morning at Sophie B.'s firm, a team member is about to pay an invoice that arrived by email. The logo looks right, the amount is plausible, the sender's address is almost identical to that of the usual supplier — a single letter has changed. She hesitates for a second, picks up the phone, and calls. It was fake, and nobody paid that day. But Sophie B. is left with a question that won't let go: what if the call had never happened? That is exactly the question a phishing simulation answers — without waiting for the real attack.
Why a phishing simulation teaches more than a training course
Let's start with the words. Phishing means a fake message that imitates a trusted source (a bank, a regular supplier, senior management) to push someone into clicking a link, entering a password or making a payment. A phishing simulation is that same fake message, but completely harmless: the company sends it to itself, under real conditions, to observe how the team reacts — who clicks, who doubts, who reports it.
For a trustee firm like Sophie B.'s, this is anything but theoretical. Her team handles the accounting, payroll and tax data of hundreds of clients every day, under professional secrecy. There is no in-house IT person, and most of the work flows through email. So an attacker doesn't need to breach a firewall or possess deep technical skills: they only need one person, on a hectic day, to trust the wrong email. The way in isn't the technology — it's human attention.
This is where training shows its limits. A classroom awareness session explains very well what people should do; it doesn't reveal what your team actually does on a Tuesday at 5 p.m., between two deadlines, when an urgent message lands. Knowing is not the same as acting under pressure. A simulation bridges that gap: it turns an abstract principle into a lived experience, with no real consequences. The Federal Office for Cybersecurity (NCSC), Switzerland's reference on the subject, likewise recommends regular awareness-raising rather than a one-off course that is quickly forgotten.
Because what phishing exploits is not technical at all. It is almost always the same mechanism: a little urgency ("to be paid today"), a pinch of authority (the message seems to come from a superior or an important partner), and above all routine — one email among a hundred, handled on the fly. In a small organisation where people know each other and decision chains are short, this mix works remarkably well: nobody wants to keep a client waiting or to double-check a request that "looks normal". A simulation lets you see that mechanism at work in your own walls, gently, rather than discovering it on the day of a real attack.
One point deserves stating up front, because it shapes everything else: a successful campaign is not about catching people out. Its goal isn't to draw up a list of "those who clicked", but to measure how solid a collective reflex is — and to strengthen it. A simulation run as a trap always backfires on whoever organises it: it breeds fear and silence, the exact opposite of what you want. The right question isn't "who fell for it?", but "what, in our organisation, helps or prevents raising a doubt in time?".
Key takeaways
- You're not testing people, you're testing collective reflexes. The aim is to learn together, not to trap or rank. A mistaken click is a data point, not a fault.
- The result is not a grade. The exact rate hardly matters: what counts is the honest conversation it opens and the reporting reflex it durably installs.
- A simulation complements technical protections, it doesn't replace them. Multi-factor authentication (MFA) — a second proof on top of the password, such as a code on your phone — and email filtering remain essential. Testing human vigilance doesn't excuse you from locking the door.
Habits to put in place this week
1. Set a kind framework first
Before you even think about the first email, tell your team that vigilance tests will take place — the principle, not the date. Decide from the outset, and say it: no names will be named, no sanction will follow. In Switzerland, informing your staff of this kind of exercise is simply part of the transparency expected under the nFADP, the new data protection act. A hidden, punitive test destroys the very trust it claims to build; an announced, educational one does exactly the opposite.
2. Aim realistic, start small
The best scenario isn't the cleverest, it's the most ordinary: a fake supplier invoice, a mailbox notification that is "expiring", a pressing internal request. There's no point building an elaborate set-up nobody will ever meet — the idea is to reflect what your team actually sees go by. A first, simple test on a limited scope will already teach you a lot, without mobilising resources you don't have. A modest, well-debriefed campaign beats a spectacular operation that leaves a bitter taste of entrapment. You can always make the scenarios harder later, once the trust framework is in place and everyone knows what to expect.
3. Prepare the debrief before you hit "send"
Decide what you'll do with the result before you even have it. Whoever clicks receives a short, educational message — "here's how you spot this kind of email" — never a scolding. Whoever reports it becomes an example you highlight. The real deliverable of a campaign isn't the click rate: it's the exchange that follows, where everyone realises they aren't alone with their doubts and that it's always better to ask. A good campaign is judged over time: if, three months later, your team spontaneously reports suspicious messages, it has succeeded, whatever the first result was.
These three habits are enough to start out healthily. What they don't replace is the rest of the journey: which scenarios to run next, how often, how to measure progress without stigmatising anyone, how to connect the simulation with your payment-verification procedure. That's a full programme, and it is built with method rather than improvised.
Where do you really stand?
A well-run phishing simulation won't tell you whether you're "protected" — no campaign can. It shows you something more useful: where your organisation still relies on each person's isolated vigilance, and where shared reflexes are genuinely starting to hold. That is exactly what the Cyber Passport self-assessment structures. It certifies nothing: it helps you locate, question by question, your awareness and your governance against recognised good practices, so you know where to move next.
Turning intent into a real programme — choosing scenarios, setting a cadence, measuring over time, framing the message to your team — takes a method. That's the whole point of the "Anti-phishing programme" blueprint, which lays out the steps one by one, which this article deliberately did not.
