# Security Awareness & Phishing Simulation Playbook
*Published by Compliance Enablers LLP | complianceenablers.com*
*Last Updated: March 2026*

---

## Introduction

Security incidents can involve human action — clicking a phishing link, using weak credentials, misconfiguring a system or falling for social engineering. A structured security awareness programme combined with realistic phishing simulations is one way to address that risk.

This playbook provides a structure for designing, implementing, measuring and continually improving a security awareness and phishing simulation program. Set targets and benchmarks from your own baseline; the sample figures in this playbook are illustrative only.

## 1. Building the Business Case

### Why Security Awareness Matters

- **Regulatory requirements**: ISO/IEC 27001:2022 clause 7.3 requires awareness; HIPAA Security Rule §164.308(a)(5) requires security awareness and training; PCI DSS v4.0.1 Requirement 12 sets awareness requirements; GDPR Article 39(1)(b) includes awareness-raising among the DPO's tasks. Confirm the requirement that applies to you.
- **Risk reduction**: A structured awareness programme is intended to reduce susceptibility to phishing; measure the effect against your own baseline.
- **Insurance requirements**: Ask your insurer whether it requires evidence of awareness training and phishing simulations.
- **Client requirements**: Ask your customers whether their due diligence requires evidence of an awareness programme.
- **Incident cost**: Phishing-related incidents can carry direct and indirect costs; build your own estimate rather than relying on an industry average.

### Presenting to Leadership

Frame the business case around:

1. **Financial impact**: Your own estimate of incident cost versus the cost of an awareness program.
2. **Regulatory exposure**: The training expectations in the frameworks that apply to you.
3. **Insurance requirements**: What your insurer asks you to demonstrate.
4. **Tracked outcomes**: Commit to tracking and reporting metrics (phish-prone percentage, report rates, response times).
5. **Peer practice**: Consider how comparable organizations structure their programs.

### Budget Considerations

A typical enterprise awareness program budget includes:

- Platform licensing (awareness training + phishing simulation).
- Content development or licensing (videos, modules, assessments).
- Internal staff time for program management.
- Incentive and gamification rewards.
- Third-party assessments (security culture surveys, external red team exercises).

## 2. Designing Your Awareness Program

### Program Structure

#### Role-Based Content

Not all employees face the same risks. Tailor content by role:

| Audience | Focus Areas |
|----------|------------|
| **All employees** | Phishing recognition, password hygiene, social engineering, physical security, incident reporting, acceptable use |
| **Developers** | Secure coding practices, OWASP Top 10, dependency management, secrets management, code review |
| **IT administrators** | Privileged access management, secure configuration, patch management, logging and monitoring, incident response |
| **Finance/Accounts** | Business email compromise (BEC), invoice fraud, wire transfer verification, payment security |
| **HR** | Data privacy, employee data handling, recruitment scams, social engineering targeting HR |
| **Executives** | CEO fraud/whale phishing, strategic risk awareness, privacy obligations, incident communication |
| **Customer support** | Social engineering via support channels, data verification procedures, escalation protocols |
| **New hires** | Onboarding security orientation, policy acknowledgment, initial phishing baseline |

#### Content Delivery Methods

Use a mix of delivery methods to maintain engagement:

- **Micro-learning modules** (3-5 minutes): Short, focused topics delivered monthly.
- **Interactive e-learning courses** (15-30 minutes): Deeper dives on critical topics, delivered quarterly.
- **Video content**: Short, engaging videos covering real-world scenarios. Use storytelling and humor where appropriate.
- **Live sessions / webinars**: Quarterly town halls or workshops on trending threats. Enables Q&A and discussion.
- **Simulated attacks**: Phishing, vishing, smishing, and QR code simulations (covered in detail below).
- **Newsletters / alerts**: Monthly security newsletters with tips, threat intelligence summaries, and recognition of security champions.
- **Posters and digital signage**: Physical and digital reminders in office spaces.
- **Gamification**: Points, leaderboards, badges, and rewards for completing training and reporting simulations.
- **Tabletop exercises**: Scenario-based group exercises for incident response teams and leadership.

#### Sample cadence

The cadence below is an example to adapt, not a Compliance Enablers requirement.

| Activity | Sample frequency |
|----------|-----------|
| Micro-learning modules | Monthly |
| In-depth e-learning courses | Quarterly |
| Phishing simulations | Monthly |
| Multi-channel simulations (SMS, voice, QR) | Quarterly |
| Security newsletter | Monthly |
| Live sessions / town halls | Quarterly |
| Security culture survey | Annually |
| Tabletop exercises | Semi-annually |
| New hire onboarding training | Within first week of employment |

## 3. Phishing Simulation Strategy

### Starting a Simulation Program

#### Phase 1: Baseline

- Send a moderate-difficulty phishing simulation to all employees (no prior warning).
- Measure baseline click rate, credential submission rate, and report rate.
- Do not name and shame — use results only for program planning.
- Record your own baseline; do not assume an industry click-rate benchmark.

#### Phase 2: Foundation

- Begin monthly simulations at low to moderate difficulty.
- Launch awareness training addressing the most common failure points from the baseline.
- Communicate transparently: "We are running simulations to help everyone improve."
- Introduce the phishing report button (email plugin for one-click reporting).

#### Phase 3: Escalation

- Increase difficulty progressively: more targeted, more realistic, more varied.
- Introduce spear-phishing simulations targeting specific departments.
- Add multi-channel attacks: SMS phishing (smishing), voice phishing (vishing), QR code phishing (quishing).
- Recognize and reward employees who consistently report simulations.

#### Phase 4: Advanced

- Use highly realistic scenarios: impersonating internal executives, mimicking actual vendor communications, leveraging current events.
- Combine techniques: email + phone follow-up, QR code in a physical document.
- Conduct red team exercises for high-risk departments (finance, IT, executives).
- Set your own improvement target from your baseline.

### Multi-Channel Simulation Types

| Channel | Description | Example Scenario |
|---------|-------------|-----------------|
| **Email phishing** | Traditional deceptive emails with malicious links or attachments | Fake password reset from IT, fake invoice from a vendor, fake package delivery notification |
| **Spear phishing** | Targeted emails using personal/organizational information | CEO requesting urgent wire transfer, HR sending "updated benefits enrollment" |
| **SMS phishing (Smishing)** | Deceptive text messages with malicious links | Fake delivery notification, fake MFA verification request, fake IT support message |
| **Voice phishing (Vishing)** | Phone calls impersonating trusted entities | IT helpdesk requesting password reset, vendor requesting payment details |
| **QR code phishing (Quishing)** | Malicious QR codes placed in emails or physical locations | Fake Wi-Fi setup instructions, fake parking payment QR code, fake document access QR |
| **USB drop** | Planted USB devices to test physical security awareness | Labeled USB drives left in common areas (lobby, parking lot, break room) |

### Difficulty Progression Matrix

| Level | Indicators | Suggested use |
|-------|-----------|---------------|
| **Easy** | Obvious spelling errors, unknown sender, generic greeting, mismatched URL clearly visible | Early baseline or first simulations |
| **Moderate** | Branded template, plausible sender, mild urgency, URL similar to legitimate domain | Routine monthly programme |
| **Hard** | Highly realistic branding, known sender name (spoofed), strong urgency or authority, convincing pretext | Later phases, after training |
| **Expert** | Personalised content from research, mimics actual business processes, multi-channel, compromised look-alike domain | Advanced programme with prior approval |

## 4. Measuring Effectiveness

### Key Metrics

#### Primary Metrics

The targets below are **illustrative examples**, not Compliance Enablers benchmarks or measured outcomes. Set targets from your own baseline and risk appetite.

| Metric | Definition | Example target |
|--------|-----------|--------|
| **Phish-Prone Percentage** | Percentage of employees who click or interact with simulated phishing | Your own reduction target |
| **Report Rate** | Percentage of employees who correctly report simulated phishing via the report button | Your own improvement target |
| **Time-to-Report** | Average time between simulation delivery and first employee report | Your own service target |
| **Credential Submission Rate** | Percentage of employees who not only click but enter credentials on a phishing page | Your own reduction target |
| **Training Completion Rate** | Percentage of employees completing assigned awareness training on time | Your own completion target |

#### Secondary Metrics

| Metric | Definition | Purpose |
|--------|-----------|---------|
| **Repeat Offenders** | Employees who fail 3+ consecutive simulations | Identify individuals needing additional intervention |
| **Department Click Rates** | Click rates broken down by department | Identify high-risk departments for targeted training |
| **Improvement Over Time** | Month-over-month or quarter-over-quarter click rate trend | Demonstrate program ROI |
| **Real Threat Reporting** | Number of real phishing attempts reported by employees | Measure behavioral change in actual threat scenarios |
| **Security Culture Score** | Composite score from security culture assessment survey | Track cultural shift toward security mindfulness |

### Calculating ROI

**Awareness Program ROI** = (Estimated breach cost x Reduction in phishing susceptibility) - Program cost

The example below is **illustrative arithmetic only**, not a measured Compliance Enablers outcome. Substitute your own baseline, cost exposure and program cost.

Example:
- Estimated annual phishing breach cost exposure: $500,000
- Assumed reduction in susceptibility: 83%
- Estimated risk reduction value: $500,000 x 0.83 = $415,000
- Annual program cost: $50,000
- Illustrative ROI: ($415,000 - $50,000) / $50,000 = 730%

## 5. Handling Repeat Offenders

Some employees may fail simulations repeatedly. Handle this constructively, not punitively.

### Intervention Framework

| Failure Count | Intervention |
|--------------|-------------|
| **1st failure** | Immediate educational feedback (landing page with explanation). Assign targeted micro-learning module. |
| **2nd failure** | One-on-one coaching session with security team. Assign additional training module. Manager notified. |
| **3rd failure** | Mandatory in-depth training session. Risk documented. Increased simulation frequency for this individual. |
| **4th failure** | Escalation to HR and management. Formal discussion about security responsibilities. Consider access restrictions. |
| **Persistent failure** | Role-based access review — reduce access to sensitive systems. Ongoing monitoring. Include in performance review discussion. |

### Important Principles

- **Never publicly shame employees**: This destroys trust and discourages reporting.
- **Focus on education, not punishment**: The goal is behavior change, not discipline.
- **Consider the individual**: Some employees may need different learning formats (visual, hands-on, one-on-one).
- **Document interventions**: Maintain records of all training and coaching for compliance evidence.
- **Recognize improvement**: When a repeat offender starts reporting correctly, acknowledge the change.

## 6. Security Culture Assessment

A security-aware employee is not the same as a security-cultured employee. Awareness is knowledge; culture is behavior and attitude. Measure both.

### Dimensions to consider

1. **Attitudes**: How employees feel about security (positive, negative, indifferent).
2. **Behaviors**: What employees actually do day-to-day regarding security practices.
3. **Cognition**: How well employees understand security threats, policies, and their role.
4. **Communication**: How effectively security information flows within the organization.
5. **Compliance**: The extent to which employees follow security policies and procedures.
6. **Norms**: What employees perceive as normal security behavior among their peers.
7. **Responsibility**: Whether employees feel personal ownership for security outcomes.

### Measuring Security Culture

- **Survey**: Distribute a security culture survey covering the dimensions you choose to measure. Track the results against your own baseline.
- **Behavioral observation**: Monitor actual behaviors — clean desk adherence, badge tailgating, document handling.
- **Simulation results**: Phishing simulation data reflects actual behavioral patterns.
- **Incident data**: Types and frequency of human-caused incidents indicate cultural maturity.
- **Focus groups**: Conduct qualitative focus groups to understand attitudes and perceptions.

## 7. Reporting to Leadership

### Monthly Report Elements

- Phishing simulation results (click rate, report rate, credential submission rate).
- Training completion rates.
- Trend charts showing improvement over time.
- Notable incidents related to human factors.
- Upcoming activities for the next month.

### Quarterly Report Elements

- All monthly elements plus:
- Department-level performance comparison.
- Repeat offender trends and interventions.
- Multi-channel simulation results.
- Budget utilization.
- Program recommendations and adjustments.

### Annual Report Elements

- All quarterly elements plus:
- Security culture survey results and year-over-year comparison.
- ROI calculation.
- Benchmarking against industry peers.
- Strategic recommendations for the following year.
- Program maturity assessment.

## 8. Sample annual calendar (illustrative)

| Month | Training Activity | Simulation Activity |
|-------|------------------|-------------------|
| **January** | Annual security refresher course (all employees) | Moderate email phish: fake IT password reset |
| **February** | Social engineering awareness module | Hard email phish: fake vendor invoice |
| **March** | Data privacy and GDPR module | Easy email phish: fake delivery notification + SMS phish |
| **April** | Secure remote working module | Moderate email phish: fake HR benefits update |
| **May** | Business email compromise (BEC) module for finance | Hard spear phish targeting finance: fake CEO wire request |
| **June** | Physical security and clean desk module | Moderate email phish + QR code quish in office poster |
| **July** | Password hygiene and MFA module | Easy email phish: fake social media alert |
| **August** | Incident reporting procedures module | Hard email phish: fake internal system notification |
| **September** | Secure coding practices (developers only) | Moderate email phish + vishing targeting IT helpdesk |
| **October** | Cybersecurity Awareness Month campaign | Multi-channel campaign: email + SMS + voice over 4 weeks |
| **November** | Third-party risk and supply chain awareness | Hard spear phish: fake vendor breach notification |
| **December** | Year-in-review and security culture survey | Expert-level holiday-themed phishing campaign |

## 9. Sample Metrics Dashboard

### Executive Summary View

The dashboard below is an **illustrative sample with fictional figures**, not measured Compliance Enablers data.

```
+-------------------------------------------------------------------+
|  SECURITY AWARENESS PROGRAM DASHBOARD - SAMPLE                    |
+-------------------------------------------------------------------+
|                                                                   |
|  Phish-Prone %     Report Rate       Avg Time-to-Report          |
|  4.2% (target <5%) 72% (target >70%) 3.8 min (target <5 min)    |
|  [DOWN from 6.1%]  [UP from 65%]     [DOWN from 5.2 min]        |
|                                                                   |
|  Training Completion    Credential Submission    Repeat Offenders |
|  97%                    0.8%                     12 employees     |
|  (target >95%)          (target <1%)             (down from 18)  |
|                                                                   |
+-------------------------------------------------------------------+
|  DEPARTMENT CLICK RATES                                           |
|  Engineering:   2.1%  | Finance:       3.5%  | Marketing: 5.8%  |
|  Sales:         6.2%  | Operations:    4.1%  | HR:        3.9%  |
|  Customer Svc:  7.1%  | Executive:     2.8%  | IT:        1.5%  |
+-------------------------------------------------------------------+
|  TREND (12 MONTHS)                                                |
|  Click Rate:  30% -> 18% -> 12% -> 8% -> 6.1% -> 4.2%          |
|  Report Rate: 15% -> 30% -> 45% -> 55% -> 65% -> 72%           |
+-------------------------------------------------------------------+
```

### Department Drill-Down View

For each department, track:

- Monthly click rates over 12 months.
- Most effective simulation types (which topics generate the most clicks).
- Training completion rate.
- Number of repeat offenders.
- Real phishing reports submitted.
- Recommended focus areas for next quarter.

## 10. Sample programme maturity model (illustrative)

### Level 1: Non-Existent

- No formal awareness program.
- No phishing simulations.
- Training is ad hoc or compliance-only (annual checkbox).

### Level 2: Initial

- Basic annual compliance training deployed.
- Occasional phishing simulations (1-2 per year).
- No metrics tracking beyond completion rates.

### Level 3: Developing

- Monthly phishing simulations with progressive difficulty.
- Quarterly training on varied topics.
- Click rates and report rates tracked.
- Phishing report button deployed.

### Level 4: Established

- Role-based training program with monthly content.
- Multi-channel simulations (email, SMS, voice, QR).
- Comprehensive metrics dashboard reported to leadership.
- Repeat offender intervention program active.
- Security culture survey conducted annually.

### Level 5: Optimized

- Security is embedded in organizational culture.
- Employees are active defenders — high report rates, low click rates.
- Real-time threat intelligence feeds into simulation scenarios.
- Continuous improvement driven by data analysis.
- Program benchmarked against industry peers.
- Recognized as a competitive differentiator.

## Conclusion

A security awareness and phishing simulation programme is not a one-time project but a continuous discipline: invest consistently, measure rigorously, communicate transparently, and treat every employee as a potential security champion rather than a liability.

Start with a baseline, set clear targets, deliver engaging content, simulate realistic threats, measure what matters, and iterate. Track your own results over time and adjust the programme to what your data shows.

---
*This resource is provided by Compliance Enablers — a GRC platform with 60 dashboard modules in 11 groups, 30 standards as guided programmes, and built-in security awareness training. Learn more at complianceenablers.com*