Phishing Simulations

A phishing simulation is a controlled test where an organization sends realistic but harmless phishing emails to its own employees. The goal is to measure who clicks, who reports, and who submits credentials, so security teams can spot vulnerable groups before a real attacker does.

Most programs deliver emails through direct mailbox injection (M365 Graph API or Google Workspace API) to bypass perimeter filters and test actual employee behavior. According to the 2024 Verizon DBIR, 68% of confirmed breaches involved a human element, and phishing remains the most common initial access vector. Organizations that run monthly campaigns with escalating difficulty typically see click rates drop 50-75% within 12 months.

Phishing simulations give security teams a measurable way to assess human risk. Instead of guessing which departments are vulnerable, you get concrete data: click rates, credential submission rates, report rates, and time-to-report across every team.

According to the 2024 Verizon DBIR, 68% of breaches involved a human element. Regular phishing simulation campaigns reduce click rates by 50-75% over 12 months when paired with targeted remediation training. The combination of testing and training compounds: each round catches fewer people, and the people it catches get trained on what they missed.

Start with a baseline campaign before announcing the program. Use difficulty level 1-2 templates initially, then increase to levels 4-5 as your organization improves. Run campaigns monthly, not quarterly, because long gaps let skills decay.

Vary your attack patterns. Rotate between credential harvest, document viewer, OAuth consent, and BEC reply simulations so employees learn to recognize multiple threat types. Always pair testing with immediate remediation training.

Avoid punitive approaches. Gotcha pages that explain the red flags and link to training produce better outcomes than naming-and-shaming lists or disciplinary action.

RansomLeak delivers phishing simulation emails through the M365 Graph API or Google Workspace API, placing them directly into employee mailboxes. This bypasses your perimeter mail filters (Mimecast, Proofpoint, Barracuda) entirely.

Direct injection matters because real phishing emails that reach the inbox have already passed your filters. Testing only what filters catch tells you nothing about employee behavior when a message gets through. Injection also eliminates SPF/DKIM alignment issues that cause simulation emails to land in spam.

Mail security tools like Mimecast, Proofpoint, and Microsoft Safe Links pre-scan email links, generating automated clicks that skew your data. The platform uses a mail-security scanner filter that detects and strips bot traffic from real clicks.

Without this, your click rates would be inflated by automated scanning, and repeat offender reports would flag people who never actually clicked anything.

Yes, with the right controls. GDPR Article 88 permits processing employee data for workplace security purposes when proper safeguards are in place. German, French, and Dutch jurisdictions require works council notification or agreement before running campaigns.

The platform includes jurisdiction declarations at campaign setup and generates the compliance documentation your legal team needs. Every campaign carries a hash-verified legal addendum to maintain an auditable chain of custody.

Phishing simulations are an add-on to the RansomLeak training platform. When an employee fails a simulation, they are automatically assigned interactive exercises from the exercise library that cover the specific attack pattern they missed.

This creates a closed loop: simulations identify who needs training, the platform delivers it, and subsequent simulations measure whether it worked. You can also attach custom learning paths and third-party SCORM content to remediation workflows.