Is phishing simulation worth it for a small business?

Yes, for most small businesses phishing simulation is worth it, as long as it's run little and often, followed by short training rather than blame, and paired with an easy way for staff to report suspicious emails. It makes staff noticeably better at spotting and reporting phishing, but it won't stop every click, so it works alongside email filtering and multi-factor authentication, not instead of them. Run badly, as a way to catch people out, it does more harm than good.

How common is phishing?

In the government's Cyber Security Breaches Survey 2025/26, phishing was by far the most common type of attack, reported by 38% of businesses. Yet only 22% of businesses had tested their staff, for example with mock phishing exercises, and 19% had run any cyber security training or awareness raising in the past year.

So most businesses face phishing regularly, and most have never checked how their staff would respond.

How phishing simulation works

1. Realistic but harmless emails are sent to your staff, imitating the tricks real attackers use: fake sign-in pages, delivery notices, shared documents and invoices.
2. Anyone who clicks is taken to a short explanation of what they missed, straight away, while it's fresh.
3. Anyone who reports it using a report button in Outlook gets credit for doing the right thing.
4. You see the results over time: who clicked, who reported, and whether things are improving.

Does it actually work?

It helps, within limits. The NCSC's guidance, Phishing attacks: defending your organisation, says plainly that "No training package, including phishing simulations, can teach users to spot every phishing attempt." Some phishing emails are good enough to fool anyone on a busy day.

What simulation does well is:

• Make staff more cautious and familiar with the latest tricks.
• Build the habit of reporting, which is the most valuable outcome. A report gives you the chance to warn everyone and block the real email.
• Show you where to focus training, by team or by type of lure.

That's why the best measure isn't just how many people clicked. Watch how many reported it, and how quickly.

The NCSC also warns that simulations run in the wrong spirit "erode trust between employees and security", and that "Employees who are afraid for their jobs will not report mistakes." A member of staff who clicks a real phishing link and says so straight away is far more useful than one who stays quiet.

How to run it without upsetting your team

• Tell everyone it's happening, and why, before the first campaign. Don't tell them when.
• Never name and shame. Results are for planning training, not for league tables of who clicked.
• Start easy and get harder as people improve.
• Avoid lures that feel cruel, such as a fake pay rise, bonus or redundancy notice. They undermine trust for little benefit.
• Make reporting easy and thank people for it, including when they report a simulation.
• Include the managers and directors. They're often the most targeted, and taking part shows it isn't about catching junior staff out.

What good security awareness training looks like

Simulations work best alongside short, regular training that covers:

• The signs of phishing, in email, texts, messaging apps and QR codes. Our guide, How to spot a phishing email, is a good place to start and can be shared with your whole team.
• Checking payment requests and changes to bank details by phone, using a number you already have.
• What to do after a click: who to tell, and that they won't be blamed.
• Passwords and multi-factor authentication, and why not to approve sign-in prompts they didn't expect.

A few minutes a month beats an hour once a year.

Where we can help

Our phishing simulation and awareness training service includes realistic simulations, more than 30 short training modules and a one-click report button for Outlook. It's £4 per user per month, excluding VAT. You can run your own campaigns, or we can set up the first one with you. Paired with our email security, fewer phishing emails reach your staff in the first place. Talk to us about getting started.

< Back to Guides