- Tell staff that practice emails will happen and why. Don't tell them when.
- Use lures that match the scams your business really faces, and skip anything that could cause distress.
- A click should lead to a one-minute lesson, nothing more. Never use results for discipline.
- Count reports as well as clicks, share team totals rather than names, and repeat monthly.
To run a phishing test on your employees, tell them in advance that practice emails will happen (but not when), send a realistic but fair practice email that matches your real risks, and make sure anyone who clicks sees a short lesson instead of a telling-off. Then count how many people reported it as well as how many clicked, share the team result, and repeat every month with a different lure.
If you want the background first (what a phishing simulation is and why it works), read our no-jargon guide to phishing simulation. This post is the practical "how", written for someone running a team of 5 to 50 without an IT department.
How do I run a phishing test on my employees? Eight steps
A good phishing test for employees is a small, repeatable routine rather than a one-off trap. These eight steps take about an hour to set up the first time.
1. Decide what you want to learn
Before you send anything, write down in one sentence what the test is for. "Find out who clicks" is a poor goal, because it leads to blame. Better goals sound like this: "Will people pause before acting on a bank-detail change?" or "Does everyone know how to report a suspicious email?" A clear goal tells you which lure to pick and what to measure.
2. Tell people practice will happen, not when
Telling staff about phishing tests in advance is what keeps them fair. Explain that practice emails are coming, why you're doing it, what happens if they click, and how to report anything suspicious. Leave out the date and what the email will look like. The UK's National Cyber Security Centre advises checking with HR before running simulations and avoiding a blame culture; its phishing guidance for organisations is worth ten minutes of your time. There's a ready-made announcement email further down this page.
3. Pick a lure that matches your real risks
The best practice email looks like the scams your business is most likely to receive. Think about where money and logins move in your business. If you pay suppliers, try a "we've changed our bank details" request (see invoice fraud and payment diversion). If you live in shared documents, try a "file shared with you" notice. Our free lure library lists eight common patterns.
Keep it proportionate. Never use fake bonuses, pay rises, redundancies, medical results, bereavement or disciplinary matters. They cause real distress or false hope, and the trust you lose is worth far more than the lesson. Don't copy real brands either: a made-up sender teaches the same lessons.
4. Choose the timing
Send practice emails during normal working hours, at a different time for each person. If everyone gets the same email at 9am on Monday, the first person to spot it tells the whole office, and you learn nothing. Avoid moments when people are genuinely stretched or anxious, such as the week of a big deadline or a restructure, and leave a week or two between your announcement and the first email.
5. Plan what happens when someone clicks
A click on a practice email should open a short, friendly lesson that shows the red flags the person missed. That's all. No email to their manager, no name on a list, no fake login page that records what they type. Write the lesson before you send the test: two or three clues, one sentence each, and a reminder of how to report. Most people feel a jolt of embarrassment, so a kind tone matters more than clever wording.
6. Measure report rate as well as click rate
The number that matters most is how many people reported the practice email, not just how many clicked. In a real attack, one quick report lets you warn everyone else. Track four things each round:
- Received: how many people the email reached.
- Clicked: how many opened the link (click rate = clicked ÷ received).
- Reported: how many flagged it (report rate = reported ÷ received).
- Time to first report: how long it took the first person to speak up.
Make reporting easy. If you're on Google Workspace, our guide to reporting phishing in Google Workspace walks through it. Otherwise, "forward it to the office manager" works fine, as long as every report gets a thank-you.
7. Use the results to help, never to discipline
Practice results should only ever be used to help people improve. The NCSC warns that punishing people for clicking emails you sent yourself "starts to resemble entrapment", and staff who fear trouble stop reporting real mistakes. Share team totals ("six of us reported this month's email"), keep individual results private, and if one person clicks repeatedly, offer a friendly chat and a little extra practice.
Results about named people are personal data under UK GDPR. Mention security training in your staff privacy notice, limit who can see individual results, and delete detailed records after a sensible period. The ICO's employment guidance covers the principles. This is general information, not legal advice.
8. Repeat monthly
One test tells you how people did on one day; a monthly routine builds a habit. Send one practice email per person each month, change the type of lure each time, and make them a little harder as the team improves. Look at the trend every quarter: rising reports and falling time to first report are the signs it's working.
How do I tell employees about a phishing test?
The simplest way to tell employees about phishing tests is a short email from the owner or manager, followed by a line in the staff handbook. Copy the email below, change the names in square brackets, and send it a week or two before your first practice email.
Then add a paragraph like this to your staff handbook or IT policy, so new starters see it too:
As part of our security training, staff may receive practice phishing emails at random times. Practice emails are harmless and never impersonate real organisations. If you click one, you will see a short lesson; no further action is taken, and results are never used in performance reviews or disciplinary matters. We record who received, clicked and reported each practice email in order to run the training and track team progress. Individual results are seen only by [role] and are deleted after [12 months]. Please report any suspicious email, real or practice, to [contact or method].
Do and don't: a quick checklist
Most of the upset caused by phishing tests comes from surprise, unfair lures or blame. This table covers all three.
| DO | DON'T |
|---|---|
| Tell staff practice emails will happen | Announce the date or the email |
| Copy the scams your business really gets | Use bonuses, redundancy, medical or bereavement lures |
Use made-up senders and .example-style domains | Impersonate real brands or real colleagues' personal lives |
| Show a one-minute lesson after a click | Collect what people type into a fake login page |
| Thank every person who reports | Name or shame anyone who clicked |
| Share team totals and trends | Use results in appraisals or discipline |
| Send at random times, monthly | Send everyone the same email at once, once a year |
Three ways to start this week
You can start a phishing test for employees today with no budget, and add structure later. Here are three options, from lightest to most complete.
Option 1: the free quiz, together, today
Put our free six-email phishing test on a shared screen at your next team meeting and decide together, email by email, what's real and what isn't. It takes about ten minutes with discussion, nobody's result is recorded, and it's a gentle way to introduce the idea before any practice emails arrive. Follow it up with our free bite-size lessons.
Option 2: do it yourself
A DIY test is possible for a very small team. Write a plausible email using the steps above, send it from an address that isn't your usual one, and point the link to a harmless page you control that shows the lesson. Then tally reports by hand. Be aware of the limits: your own email filtering may send it to spam, it's hard to tell who clicked without tracking, and everyone may recognise your writing. Never build a page that asks for a real password. Some business email platforms include simulation features on certain plans, so check your provider's admin documentation too.
Option 3: use a tool built for small teams
A dedicated tool handles random timing, lessons, report tracking and private results for you. That's what Lureproof does for teams of 5 to 50. Practice emails are live today for Google Workspace (an admin authorises them once in Google Admin) and coming soon for Zoho, Microsoft 365 and other providers. Anyone who clicks gets a friendly 60-second lesson on the red flags, and the leaderboard rewards people who report scams without ever naming clickers.
Whatever email you use, the monthly hands-on assessment works today: about 15 minutes covering inbox triage, lookalike links, fake login pages, voice deepfakes and a practice chat with a pretend "supplier". It's free for up to five people, and you can start in a few minutes. For how this fits into a wider programme, see our guide to security awareness training for small businesses.
FAQ
Should you tell employees about phishing tests?
Yes. Tell them that practice emails will happen, why, and what happens if they click, but not when they will arrive or what they will look like. Being open keeps trust without spoiling the practice.
What should I do if an employee fails a phishing test?
Nothing formal. They should see a short lesson on the red flags they missed, and that is the end of it. If someone clicks several times, offer a friendly chat and a little extra practice. Never use practice results for discipline.
Is it legal to phishing test employees in the UK?
Practice phishing emails are a common part of security training in the UK. Keep it fair: tell staff in advance, cover it in your staff privacy notice, keep results private and proportionate, and never punish clicks. This is general information, not legal advice.
How often should you run a phishing test on employees?
Monthly works well for most small teams: one practice email per person at a random time, with a different kind of lure each month. Quarterly is a reasonable minimum if you are just starting.