PHISHING SIMULATION: Understand how suspicious requests are recognised and reported.
Phishing simulation uses controlled deceptive messages to examine how staff recognise, verify and report suspicious requests. Subdux designs exercises around relevant work situations, evaluates reporting and response patterns and identifies focused learning or process changes, interpreting results in context rather than reducing the exercise to who clicked.
- Discipline
- Managed Security & Advisory
- Engagement type
- Training
The useful result is what the exercise helps you change.
An unexpected invoice and a routine document request create different challenges for different teams. Click rates are affected by the scenario, its timing and how closely it resembles the recipient's work. We consider those conditions alongside reporting behaviour and follow-up, so a harder exercise is not mistaken for a sudden decline in awareness.
This service is useful when you want to evaluate an existing awareness programme, practise reporting suspicious messages or understand how a particular workflow creates exposure. Findings can also reveal a verification process that needs to improve, rather than a topic that needs another training session.
Design the simulation around a useful learning objective.
Audience and scenario
Select the participating teams and a plausible request suited to their responsibilities, with appropriate exclusions.
Controlled delivery
Prepare the sending arrangements and test the exercise so it behaves as intended without introducing harmful content.
Safe interaction
Use controlled landing experiences and indicators that support evaluation without collecting real passwords.
Reporting and handling
Observe whether people recognise and report the message and how the receiving team handles those reports.
Focused feedback
Explain relevant cues, reinforce the correct reporting route and connect lessons to the action people can take next time.
Read the behaviour alongside the circumstances.
We report relevant interaction and reporting measures, the context of the scenario and limitations in the data. Automated security checks can affect observed link activity, so measurement needs interpretation. Findings should help you adjust training, reporting or verification arrangements; they should not turn a controlled exercise into a public ranking of employees.
What you receive
The exercise plan and approved scenarios; campaign results with measurement notes; observations about reporting and handling; targeted learning material; and recommendations for the next exercise or operational improvement.
Do you collect employees' passwords?
We record the interaction with a simulated sign-in page without collecting genuine passwords. The exercise is designed to show where verification, reporting or guidance needs attention.
Can we compare the click rate with another campaign?
Only with context. Different difficulty, audiences, delivery conditions and automated link activity can affect the figures. We examine those factors before treating a change as evidence of better or worse judgement.
Will everyone receive the same follow-up?
They do not have to. Feedback can reflect the scenario and the needs of the audience. We agree how results will be shared and use them to support learning and useful process changes.
Make the next simulation answer a practical question.
Tell us which teams, suspicious requests or reporting behaviours you want to understand before selecting a campaign.
Related services: Employee Security Awareness Training and Incident Readiness & Tabletop Exercises.