A phishing test is a fake attack you run on your own people, on purpose.
A message that looks like the real thing lands in their inbox, and the only thing at stake is a lesson. The emails in a good test are not the obvious ones.
The IT notice. "Your password expires today. Sign in to keep your mailbox." The sign-in page is a copy. This is the one most people fall for, because it looks like something we might send.
The invoice. "Attached is the invoice we discussed." From a vendor's name, with a file or a link. Accounting opens it, because opening invoices is the job.
The shared file. "Jane shared a document with you." The name is real, lifted from the company's own website or LinkedIn. The link asks you to sign in to see the file.
The boss in a hurry. "I'm in a meeting, can you pick up some gift cards and send me the codes." Sometimes an email, often a text. It works on the newest person in the office.
The delivery. "Your package could not be delivered. Confirm your address." Nobody at work was expecting a package. The click happens anyway.
What happens when someone clicks. A short page says this was a test, shows the two things that gave it away, and takes a minute. No name goes on a list in a meeting. The people who reported the message instead of clicking hear that they did the right thing. Then it runs again next quarter, with a different message.
One test teaches nothing. A year of them changes habits.
Two numbers tell you whether it is working.
| The number | What it should do over a year |
|---|---|
| The share of people who click | Fall |
| The share of people who report the message | Rise. This one matters more |
A company where people report a strange email within minutes is a company where the real one gets caught.
For our clients, the test is part of the plan: short, regular training and a phishing test every quarter, run by us, with the results read to you in plain words. Nine signs an email is a phish is the list of tells.
Questions people ask
What is a phishing test?
A fake phishing email sent to your own people on purpose, so the ones who click learn from it before a real one arrives. Nothing is at stake but the lesson.
How often should a business run a phishing test?
Every quarter, with a different message each time. A single test shows where you stand; a year of them changes habits.
What happens when someone clicks in a phishing test?
A short page tells them it was a test and shows what gave it away. Nobody is named or embarrassed, and the people who reported the message hear that they did the right thing.