Running a phishing campaign: training employees with realistic simulations

What is a phishing campaign?

Phishing campaigns are among the most widely used cyber attack methods. They aim to trick people into revealing confidential information. Attackers usually send emails or messages that at first glance seem to come from legitimate senders, to win the recipients' trust and get them to hand over data. Whether through fake websites, links or attachments, cyber criminals use different tactics to obtain information such as passwords, payment details or personal data. Such a campaign is often broad and reaches many potential victims, with the aim of collecting as much data as possible.

Phishing is the most common attack method against companies

Definition and how phishing works

Phishing is one of the social engineering techniques in which attackers manipulate victims into trusting them. The strategy is designed to push recipients into quick, unconsidered actions – often clicking a link or entering sensitive information.

The most common approach of phishing attacks can be broken down into three steps:

1. Imitating a reputable source: the attackers design messages that look authentic and resemble the style of a well-known company, bank or authority.
2. Creating urgency: with phrases such as "immediate action required" or "your account has been restricted", the criminals put recipients under pressure.
3. Provoking an action: the messages often contain links or attachments that lead to information being disclosed or install malware.

Different types of phishing

Phishing is a versatile attack method used in different forms and through different channels. The most important variants are:

• Spear phishing: this targeted form is often aimed at specific people or organizations, such as executives or employees in sensitive positions. The attackers collect detailed information about the target beforehand to make the email more credible.
• Whaling: similar to spear phishing, but tailored specifically to senior executives (e.g. CEOs or CFOs). These attacks are complex and target information of high business value.
• Smishing: the attack takes place via SMS. Supposed messages from delivery services, banks or other services are meant to get victims to click links or reply.
• Vishing: this type of phishing uses phone calls. The criminals pose as representatives of trustworthy companies to ask for sensitive information directly.
• Clone phishing: messages that have already been sent are copied, slightly modified and sent again, often with a malicious attachment or manipulated link.

Each of these variants uses targeted psychological approaches to deceive its victims and compromise their security.

How cyber criminals run phishing campaigns

A phishing campaign usually runs in several steps that the attackers plan in detail beforehand:

1. Research and preparation: before a campaign starts, the criminals analyze their targets and collect information they can use to personalize their messages (OSINT: open source intelligence).
2. Creating the phishing content: the attackers design emails or text messages that match a familiar communication style and layout, relying on logos, design and typical wording to maximize the deception.
3. Developing an attack plan: a detailed plan defines the order and specific goals of the attack – how and when victims are contacted, which deception methods are used and how responses are analyzed.
4. Attack launch: the content is sent through various channels (email, SMS, social media) and contains links or attachments meant to spread malware or give access to internal networks.
5. Collecting and using the stolen data: as soon as a password is entered, the attackers' system automatically checks whether it is correct. If it is, it is used immediately for criminal activities, such as unauthorised purchases or access to further sensitive data and systems.

Planning such campaigns requires in-depth analysis and the targeted exploitation of psychological factors. These attacks are therefore particularly insidious and a real threat to companies and individuals.

How do I recognize phishing emails?

Typical signs of fake emails

Recognizing phishing emails is a core skill for protecting yourself and your company. Typical signs of a phishing email are:

• Suspicious sender address: the sender domain often does not match the name of the company given.
• Language anomalies: mistakes can be a sign – but thanks to AI many phishing emails are now flawless. A lack of mistakes is therefore no proof of authenticity.
• Links to fake websites: an inconspicuous link can lead to an insecure website that captures data.
• Urgency and threats: statements such as "final warning!" or "account blocked!" are meant to make the reader react quickly.

An example from a client phishing simulation:

Reliable techniques for identifying phishing

Several techniques help you recognize phishing and respond safely:

The role of security awareness in recognizing phishing

Strong awareness of security risks is the first step to recognizing phishing. Security awareness training sensitizes employees to the danger of such attacks. When security awareness is actively anchored in the company culture, employees are better able to tell legitimate from fraudulent messages.

What is a phishing simulation and how does it help?

What are the benefits of a phishing simulation for companies?

Phishing simulations are an effective way to prepare staff for real phishing threats. In these exercises, employees receive imitation phishing emails; the evaluation is aggregated, without exposing individuals. This makes it possible to identify weaknesses and offer targeted training.

How do simulated phishing attacks work?

Simulated phishing attacks use controlled emails designed to reflect typical phishing techniques. Employees who respond to the message are informed and receive targeted training to strengthen their security awareness.

Our tips for effective phishing simulations

For a successful phishing simulation we recommend a staged approach:

1. Start simple: begin with easily recognizable messages.
2. Increase the difficulty: use more complex simulations to sharpen recognition.
3. Repeat regularly: recurring simulations create lasting learning.

How can I strengthen security awareness in my company?

A strong security mindset among employees is crucial for making a company more resilient against cyber attacks. Phishing, social engineering and other threats often target human weaknesses. Security should therefore be integrated into everyday work continuously, to reduce the attack surface and raise awareness of risks. Key elements are phishing simulations and well-structured, regularly updated security awareness training.

The importance of security awareness training

Security awareness training is essential to prepare staff for cyber risks and give them the skills to recognize potential dangers. Good training strengthens employees' confidence in dealing with suspicious emails, requests or links and helps them make security-conscious decisions.

Effective security awareness training should:

1. include realistic scenarios tailored to the specific challenges and attack types of the industry,
2. be interactive and practical, so that employees develop an active understanding through exercises such as phishing simulations and realistic case studies,
3. address current threats, to be prepared for the latest developments in cyber crime.

Training strategies for employees

To raise awareness of security risks successfully, it makes sense to use different training approaches that meet the different needs of employees. Proven strategies include:

• Introductory training for new employees: basic security knowledge should be taught during onboarding, so that new team members understand early on how important secure behavior is.
• Regular refresher courses: training should be repeated and updated at regular intervals so that everyone stays informed – short, regular sessions work well for deepening knowledge and passing on practical tips.
• Special training for critical departments: departments such as IT, finance or HR often have access to particularly sensitive information and need in-depth training on their specific threats and protective measures.
• Interactive formats and analyses: formats such as gap analyses, case studies or simulated attacks provide a practical basis that helps the team improve its response to a cyber attack.

Regular refreshers and testing security knowledge

The cyber security landscape is dynamic and constantly changing. It is therefore essential to keep employees' knowledge up to date and adapt security measures regularly.

• Updating training content: security awareness content should be continuously aligned with new threats and developments, including new attack methods such as current phishing techniques or social engineering tricks.
• Regular tests: to assess how effective training is and measure learning, regular tests make sense – short online tests, quizzes or simulated phishing emails. The results show gaps in security skills and where follow-up training is needed.
• Feedback and adjustment: staff feedback on training should be used actively to keep improving formats and content. An open dialogue makes it possible to address specific questions and uncertainties and strengthen security awareness for the long term.

Why the how decides between success and harm

A phishing simulation does not run itself – done badly, it does more harm than good. A study by the Karlsruhe Institute of Technology (KIT) and Ruhr University Bochum (German) examined phishing campaigns from three angles – security, law and the human factor – and warns of an underestimated effect:

People who realize they have fallen for a test email lose self-efficacy and respond not with vigilance but with resignation.

Campaigns without prior announcement also damage trust in management and the error culture – and raise questions under employment law.

That is exactly why we do not aim to "catch" people but to help them learn: transparently announced, without exposing individuals, with a real aha moment right after the click. A simulation should strengthen your employees, not show them up.

How 360 DIGITALE TRANSFORMATION supports you with a successful phishing simulation

Our phishing campaigns do not put your company at risk – they are only a simulation. We process the data needed for the simulation (e.g. email addresses) exclusively on the basis of a data processing agreement and delete it after an agreed period (usually 60 days). Our phishing simulation offer includes comprehensive multi-stage security awareness training for your company:

Phase 1: initial meeting and objectives
First, we hold a detailed discussion with you to define the specific requirements and goals of your phishing simulation. We identify potential weaknesses and agree on the focus of the simulation together.

Phase 2: campaign preparation
Before the campaign starts, we develop individual scenarios that imitate realistic threats. We take industry-specific risks into account and create targeted emails that simulate your employees' everyday work. Some technical settings need to be made on your side. All preparations are carried out in close coordination with you to ensure the campaign succeeds.

Phase 3: running the simulation
The phishing simulation itself usually runs in two stages:

• Stage 1: a simple simulation measures your employees' click and open rates and creates initial awareness.
• Stage 2: a few weeks later, a more demanding campaign follows, using realistic scenarios such as fake login pages of well-known services (e.g. Google or Microsoft).
  From our projects we know that the expected results are:
• an open rate of around 15–20 % and
• credential disclosure of around 1 %.
  After the simulation, all users are redirected to a real landing page to support the learning curve.

Phase 4: report and results presentation
We then analyze the results of the campaign in detail and prepare them for presentation. In a final session we discuss the results with management and derive concrete measures to strengthen the security culture in your company for the long term.

Phase 5: next steps
Based on the results we propose further measures, including continuous phishing simulation to promote security awareness over the long term and a complementary e-learning program for your employees. The goal is not just isolated improvements but a lasting security-conscious company culture.

Price: a phishing campaign (all five phases including report and results presentation) costs €2,500 for companies with up to 50 employees and from €3,750 for 50 employees or more – as a fixed price, plus VAT.

Discuss your options for a tailored security concept – book a consultation now.

Initial consultation by video conference

We offer a free 45-minute initial consultation by video conference. Benefit from expert advice tailored to your planned phishing campaign.

Use the opportunity to clarify your questions and get valuable tips. The free consultation is an excellent way to plan your first steps with professional advice.

Our consultants are qualified, among other things, as ISO 27001 lead auditors and bring practical experience from working with more than 50 clients.