What Is This Module For?
The Phishing Simulation module helps you run internal phishing simulation campaigns to test and improve your employees' security awareness — a key control required by DPDP Act Section 8(5), ISO 27001, and SOC 2.
Why Is This Important?
Over 90% of data breaches begin with a phishing email. Regular phishing simulations — followed by targeted training — measurably reduce your organisation's susceptibility to social engineering attacks.
Step-by-Step Guide
- Go to Phishing Simulations in the sidebar.
- Click "New Campaign" — select a phishing template (credential harvesting, attachment, invoice fraud, etc.).
- Select your target group — all employees, or specific departments (finance, HR, executives).
- Schedule the campaign — set the send date and end date.
- Review results — click rate, credential submission rate, and reporting rate by department.
- Assign training — employees who clicked are automatically assigned a short security awareness module.
Common Mistakes to Avoid
- Only testing technical staff — Finance, HR, and executive assistants are the highest-risk targets. Include all departments.
- Running simulations without follow-up training — The simulation is not useful unless employees who failed receive immediate, targeted training.
Frequently Asked Questions
Q: Will employees know the phishing emails are simulated?
A: No. The simulation uses realistic-looking emails. Employees are only informed after they click, which is when the training is most effective.
Q: How often should we run phishing simulations?
A: At least quarterly. Monthly campaigns are recommended for high-risk industries (financial services, healthcare).