Article contents
In Ukraine, you order a phishing simulation for employees from a cybersecurity company that agrees the scenarios and the audience in writing before launch, does not store entered passwords and shows management results without names, by department and role. What you get is not a list of "who fell for it" but answers to three questions: which emails work on your team, how quickly people report a suspicious email and what to change in processes and training.
Below is how to run a simulation legally and without shaming, what scenarios look like by difficulty, which metrics actually tell you something, what to ask a provider and how often to repeat.
In short
- First, a written decision by management listing people, scenarios and dates, with HR informed in advance.
- No shaming and no punishment. Results are aggregated, passwords are not stored.
- Scenarios from easy to hard, so you can see exactly where the process breaks.
- The main metric: how many people reported the email and how quickly, not only how many clicked.
- One simulation shows where you stand, the second shows change. Repeat after an agreed interval.
What a phishing simulation is
A phishing simulation means a training email campaign that a company decides to send to its own people to see how the team reacts to a convincing fraudulent email, and to teach them to spot and report such emails. Nobody loses anything: the link leads to a training page, and entered data is not stored.
A simulation does not replace technical email protection. If SPF, DKIM and DMARC are not set up, start there: how to do it is covered in how to protect company email from phishing. Nor does it test your systems: whether your website or customer area can be broken into is shown by a penetration test.
Legal and ethical: four rules
The NCSC (the UK National Cyber Security Centre) warns plainly that no training will teach people to spot every phishing email, and that punishing people for clicking on emails you sent yourself creates legal risk. That is why a simulation is agreed with HR. [1]
- Written approval by the employer. The simulation is run on behalf of the company by a management decision that names the audience, scenarios, dates and who knows about the test. If you have employment law doubts, agree the format with a lawyer.
- No shaming. Nobody gets a reprimand for a click. The NCSC explains that people who fear punishment do not report mistakes, while reporting is exactly what makes them an early warning system. [1]
- Aggregated results. Management sees the picture by department and role. Individual results, if needed at all, are seen only by whoever runs the training.
- Data protection. Collect the minimum: whether an email was opened, clicked, data entered and reported. Passwords are not stored, the retention period and access to the data are agreed in advance, and the data is deleted after the project. This is employees' personal data, so Ukraine's Law on Personal Data Protection applies, and the GDPR too if you work with the EU.
Agree separately which topics are off limits. Emails about layoffs, salaries, health or the war will work, but they destroy trust in whoever runs the training. Do not impersonate government bodies either.
Scenarios by difficulty
NIST (the US National Institute of Standards and Technology) developed the Phish Scale: a method that rates the difficulty of a training email by the number of cues that give it away and by how closely its premise matches the work of a specific audience. The result is low, medium or high difficulty. [2] [3] Without it, a low click rate may mean not that people are careful but that the emails were too easy.
- Low difficulty. A generic "your mailbox is full" email from an unrelated domain, with typos and an odd link. Shows the baseline.
- Medium difficulty. A familiar service: a shared document, a delivery notice, a request to change your Microsoft 365 password. The domain looks close to the real one, and there are few cues.
- High difficulty. A topic from the department's real work: an invoice from a "supplier" for accounting, an urgent request from a "manager", a QR code in an attachment. This is what attacks that cost money look like.
Start with low or medium difficulty and move up. For accounting and anyone who makes payments, a separate high difficulty scenario is almost always useful.
Metrics that matter
| Metric | What it shows | A good sign |
|---|---|---|
| Report rate | How many people pressed "Report" | Grows from one simulation to the next |
| Time to first report | How quickly IT learns about an attack | Minutes, not hours |
| Data entry rate | How many people reached the most dangerous step | Lower than the click rate, and falling |
| Click rate | How many people followed the link | Read only together with scenario difficulty |
| Results by department and role | Where the process is weaker and why | Shows who needs targeted training |
The click rate on its own means little. What matters more is whether anyone reported the email and how quickly: if the first report comes within minutes, IT can remove a real phishing email from every mailbox before most people have opened it. In its Attack simulation training reports, Microsoft shows separately who reported the email and when. [4]
Where to order: what to ask a provider
There are two routes. The first is the built-in Attack simulation training in Microsoft 365, available with Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5. [5] Your administrator sets it up, while scenarios, debriefs and training stay with you. The second is an outside provider who prepares scenarios for your company and runs the campaign and the debrief. For their emails to reach people, your administrator adds them to the delivery settings for third party phishing simulations. [6]
| Question for the provider | A good answer | A red flag |
|---|---|---|
| Who agrees the scenarios and audience, and how? | In writing, before launch, together with HR | "Trust us, the surprise matters" |
| Do you store entered passwords? | No, we only record that data was entered | Yes, or "we don't know" |
| What report will management get? | Aggregated, by department and role | A list of names of "who fell for it" |
| Which metrics do you track? | Reports, time to report, data entry, clicks | Only the click rate |
| How do you rate scenario difficulty? | Difficulty levels, for example by the NIST Phish Scale | "Our emails always work" |
| Where is the data stored, and for how long? | A stated period and deletion after the project | No answer |
| What happens after the campaign? | A debrief with management and training on your own examples | Just a number in a report |
| Will there be a repeat simulation? | Yes, after an agreed interval | A one-off |
How often to run one
For most companies a sensible rhythm is a full simulation once or twice a year, plus a repeat after big changes such as moving to a new email service or rapid team growth. For accounting and anyone with access to payments, short targeted scenarios can run more often. What matters is not the number of campaigns but what changes between them: rules, settings, training. For a very small team the statistics show little, so a short debrief on real examples is more useful there.
This is how we run phishing simulations: scenarios and boundaries agreed before launch, an aggregated report, a debrief after the campaign and a repeat after an agreed interval. If the question is not only about people but also about what can be broken into from outside, that is work for a penetration test.
Simulation preparation checklist
Download the preparation checklist (PDF)PDF · A4
FAQ
Where can I order a phishing simulation for employees in Ukraine?
From a cybersecurity company that agrees scenarios in writing, does not store passwords and gives an aggregated report with a debrief. If you have Microsoft 365 with Defender for Office 365 Plan 2, you can start with the built-in Attack simulation training, but then you prepare scenarios and training yourself.
Is it legal to test employees with phishing emails?
Yes, if the company runs the simulation by a written management decision, with HR informed and in line with personal data law. Results are not used to punish anyone. If you have employment law doubts, agree the format with a lawyer.
Should employees be warned about the simulation?
You can announce the overall training program in advance, but not the date or the scenario, or the result will show nothing. The moment of disclosure is agreed with management, and after the simulation everyone learns it was training.
What should we do with people who clicked?
Nothing punitive. Someone who clicked and reported straight away did everything right. For those who entered data, a short debrief using that very email helps.
Does a simulation make sense for a small company?
For a team of a few people the statistics show nothing, so a short debrief on real examples works better. Our simulations are designed for teams of 20 people or more.
References
- NCSC: Phishing attacks: defending your organisation ncsc.gov.uk
- NIST: Phish Scale, NIST-developed method helps IT staff see why users click on fraudulent emails nist.gov
- NIST TN 2276: NIST Phish Scale User Guide nvlpubs.nist.gov
- Microsoft Learn: Reports for Attack simulation training learn.microsoft.com
- Microsoft Learn: Get started using Attack simulation training learn.microsoft.com
- Microsoft Learn: Configure the advanced delivery policy for non-Microsoft phishing simulations learn.microsoft.com
