--- title: 'Phishing simulation & security awareness training' url: 'https://triplepoint.org.uk/security/people-and-email/phishing-simulation' markdown: 'https://triplepoint.org.uk/security/people-and-email/phishing-simulation.md' date: '2026-09-28' description: 'Phishing simulation and security awareness training for UK businesses. Test your staff with realistic, harmless phishing emails and give anyone who clicks short, targeted training.' --- # Phishing simulation & security awareness training The riskEmail filtering stops the vast majority of phishing, but no filter catches everything, and attackers change their tactics constantly. That leaves the last line of defence as a busy member of staff deciding whether to click a link or open an attachment. Most people who click aren't careless. The email looked real, it arrived at a busy moment, and nobody had ever shown them what to look for. What it does- Realistic simulated phishing emails, from easy to spot to genuinely convincing, sent on a schedule you control - Simulations of the tricks real attackers use: fake login pages, malicious links and dangerous attachments - Anyone who clicks can be taken straight to short training on what they missed - More than 30 security awareness and compliance training modules, in nine languages - A one-click "report phishing" button in Outlook, so staff can flag anything suspicious, real or simulated - Reports showing who clicked, who reported it, and how your organisation improves over time Who it's forAny business whose staff use email... which is every business. It's especially worth having if you're working towards ISO 27001 (which expects staff security awareness), if your cyber insurer asks how you train staff, or if you've already had a near miss with a phishing email. How we supply itBy default we supply the licence and you run your own campaigns from a straightforward dashboard. If you'd rather hand it over, we can set it up for you at our standard day rate: loading your users, installing the Outlook report button, and planning a first campaign and training schedule with you. What's under the hood**Sophos Phish Threat** — managed from the same cloud console as the rest of your protection. If you also use our email security, the two work together: staff who click real malicious links that get blocked can be automatically enrolled in extra simulations and training. Questions Won't our staff feel tricked?+It helps to tell staff that simulated phishing is part of how the business stays secure — just not when it's happening. The point is learning, not catching people out: anyone who clicks gets immediate, short training rather than a telling-off, and the results are best used to see where more training is needed, not to single people out. How often should we run a campaign?+Little and often works better than one big test a year. A short campaign every month or quarter, getting harder as your staff improve, keeps it fresh without becoming a chore. Do we need your email security to use this?+No. Simulations go to your staff's normal mailboxes whatever email service you use; you'll just need to let the simulation emails through your filtering, which we can help with. The one-click report button is an Outlook add-in for Microsoft 365 or Exchange. Is this the same as email filtering?+No, they do different jobs. Email security stops malicious messages reaching inboxes; phishing simulation prepares your people for the ones that still get through. Most businesses benefit from both. How does this benefit our staff?+Seeing the tricks attackers use at work helps them spot malicious emails in their personal inbox too, so they're less likely to fall for attacks aimed at them. [← Back to Protect your people and email](https://triplepoint.org.uk/security/people-and-email) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that matter most for it — no obligation, and no jargon. [Talk to us →](https://triplepoint.org.uk/contact?about=Phishing%20simulation%20%26%20training) or [see every security area →](https://triplepoint.org.uk/security) --- ## Navigation - Parent: [Email and people protection](https://triplepoint.org.uk/security/people-and-email.md) - Previous: [Email security](https://triplepoint.org.uk/security/people-and-email/email-security.md) - Next: [Safe browsing & web filtering](https://triplepoint.org.uk/security/people-and-email/web-filtering.md)