Phishing Campaigns Explained: Simulation and Training for Security+

A phishing campaign, in the Security+ sense, is an internal simulation: you send your own staff a realistic but harmless phishing email, measure what happens, and use the result to target training.

The exam treats it as a security awareness control, and the questions tend to be about what you measure and how you run it responsibly rather than how to craft the email.

Why simulate at all

Technical controls stop a great deal of phishing, and some still arrives. Once it does, the decision rests with a person. Training that consists of an annual slide deck does not change behaviour under time pressure; practice does, and the only way to know whether it worked is to measure.

Simulations also find where the risk is concentrated. A finance team that handles payment changes is a different exposure from a warehouse team that rarely uses email, and the response should differ.

Running one

Get authorisation first. Written approval from senior management, and involve HR and legal before anything is sent. This is testing employees, and it has employment-relations consequences.

Define the objective. Baseline measurement, targeted training, or testing whether reporting works. The design follows from it.

Choose difficulty deliberately. An obvious template flatters the numbers. A perfect internal-looking spoof will catch almost everyone and teaches nothing except that people are fallible. Vary difficulty across campaigns.

Set up tracking and safety. Landing pages must be harmless, must not capture real credentials, and should identify themselves as a test immediately after the click.

Deliver training at the moment of failure. Someone who has just clicked is far more receptive than the same person in a scheduled session weeks later.

Repeat and trend. One campaign is a snapshot; the value is in the direction of travel.

The metrics

Metric	What it tells you
Delivery rate	How many reached the inbox — tests your filters too
Open rate	Weak signal; opening is not a compromise
Click rate	The headline number, and the most over-interpreted
Credential submission rate	Far more serious than a click
Report rate	How many reported it — the metric that actually matters
Time to first report	How fast the SOC would have learned of a real campaign

The point CompTIA makes, and that organisations miss, is that report rate matters more than click rate. Some clicks are inevitable at any scale. What determines whether a real campaign becomes an incident is whether anyone tells the security team quickly. A workforce with a 10% click rate and a 60% report rate is in far better shape than one with a 5% click rate and nobody reporting.

Time to first report is the operational number: if the first report arrives in four minutes, the SOC can block the sender and pull the message before most people have opened it.

The ethics

This comes up in exam questions about programme design, and it matters in practice.

Do not punish clicks. Disciplining people for failing a simulation destroys reporting — staff who fear consequences hide mistakes, which is precisely the opposite of what you need. Educate instead.

Avoid cruel pretexts. Fake bonus announcements, false redundancy notices and bogus benefit changes generate high click rates and genuine distress, and they damage trust in the security team for years. Several organisations have had to apologise publicly for exactly this.

Report aggregate results to management, not lists of named individuals. Tell staff the programme exists, even if not when each campaign runs.

Making reporting easy

A one-click report button in the mail client, and an address everyone knows. Acknowledge reports, including false alarms, because someone thanked for reporting a legitimate newsletter will report again, and someone made to feel foolish will not. Feed reports into the SOC workflow so a genuine campaign triggers a real response.

The related vocabulary

Phishing is broad and untargeted. Spear phishing targets a specific person or group with researched detail. Whaling targets senior executives. Vishing is voice, smishing is SMS, and quishing uses QR codes. Pharming redirects victims via DNS manipulation without any lure at all. Business email compromise uses a real or spoofed executive account to authorise fraudulent payments.

What to remember

Phishing campaigns are authorised internal simulations measuring behaviour and directing training. Get management, HR and legal approval first. Report rate and time to first report matter more than click rate. Deliver training immediately on failure, never punish clicks, and avoid pretexts that cause genuine distress.

Related reading: Vishing · Obfuscated links · DKIM