Phishing simulation for small businesses: a no-jargon guide

What a phishing simulation actually is

A phishing simulation is a practice email. It looks like the kind of message an attacker might send, such as a shared document, a delivery notice or a password reset, but it comes from you and nothing bad happens when someone clicks. Instead of a fake login page that steals a password, the person lands on a short lesson that shows them what they missed.

Think of it as a fire drill for email. Nobody expects staff to learn fire safety from a poster. You walk the route a couple of times a year so that, when the alarm is real, people already know what to do. Practice emails do the same for the pause-and-check habit that stops real phishing.

For a small business this matters more than it might seem. You probably don't have a security team, layers of expensive email filtering or someone watching for trouble overnight. The person reading the email is often the last check before money moves or a password is typed in. Practice gives that person a fair chance.

What a practice email looks like

Here's the kind of thing a small team might receive. It's polite, plausible and short, which is exactly why it works as practice.

If Jordan clicks, the next screen explains the clues in plain words and takes about a minute to read. If Jordan spots it and tells whoever looks after IT, that's a win worth celebrating.

Is phishing simulation legal and fair?

This section is general information, not legal advice. If you're unsure about your own situation, speak to an employment or data protection adviser.

In the UK, sending practice phishing emails to your own staff is a widely used part of security training. What keeps it fair is mostly common sense, and it's the same things that keep people on side.

Be open that practice happens

You don't need to announce the date or the email. That would defeat the point. But staff should know that practice emails are part of how the business trains, why you're doing it, and what happens if they click: a short lesson, nothing more. A paragraph in the staff handbook and a quick mention at a team meeting is usually enough.

Keep it proportionate

Practice emails should feel like everyday work email, not personal traps. Steer clear of lures that could cause real distress or false hope, such as redundancies, medical results, bereavement or a surprise bonus. The aim is to build a habit, not to see how far you can push someone.

Handle the data properly

A simulation records who received a practice email and who clicked. That's personal data, so UK GDPR applies. In practice, that means:

• Mention security training, including practice emails, in your staff privacy notice.
• Collect only what you need to run the training and show progress.
• Decide who can see individual results, and keep that group small.
• Don't keep detailed results forever. Pick a sensible retention period and stick to it.

Don't impersonate real brands

It's tempting to copy a well-known delivery firm or software company, because that's what attackers do. Don't. Using a real company's name and logo can land you in trouble with that company, and it isn't needed. Made-up senders teach the same lessons: check the domain, check the link, question the request.

Never use results for discipline

This is the most important rule. If clicking a practice email leads to a telling-off, people learn to hide mistakes, including real ones. Someone who clicks a real phishing link and owns up within five minutes has done you a huge favour. You want everyone to feel safe doing that. Say so plainly when you introduce practice emails, and stick to it.

How often should you run it?

Little and often works better than one big test. A single annual exercise tells you how people did on one day. It doesn't build a habit. Most small teams settle somewhere between monthly and quarterly.

• Monthly keeps the pause-and-check reflex fresh and gives you a steady picture of progress.
• Quarterly is a reasonable minimum, and a gentle place to start if your team is new to this.
• Random timing matters as much as frequency. If everyone gets the same email at 9am on the first Monday, the first person to spot it warns the whole office.

Vary the lures too. If every practice email is a parcel notice, people learn to spot parcel notices, not phishing. Mix shared documents, password resets, overdue invoices, mailbox warnings and HR updates. Our lure library shows the common patterns and their red flags.

How to roll it out without upsetting anyone

Most of the upset around phishing simulation comes from surprise and blame. Remove both and it tends to be a non-event. Here's a simple rollout for a team of five to fifty.

1. Tell people first. Send a short note from the owner or manager. Something like: “We're starting regular practice emails to help us all spot scams. If you click one, you'll see a one-minute tip. Nobody gets in trouble.”
2. Agree what reporting means. Pick one simple action, such as forwarding anything suspicious to the person who looks after IT, and make sure they reply with a thank-you.
3. Make sure the emails arrive. Practice emails need to land in inboxes, not spam folders. Whoever manages your Google Workspace or Zoho account sets up allowlisting once.
4. Start gently. Begin with a fairly easy lure so people get used to the idea and see what the lesson looks like.
5. Share team results, not names. “Seven of us spotted this month's practice email” is motivating. A list of who clicked is not.
6. Keep going. The value builds over months, not in the first round.

Expect some people to click early on. That's normal, and it's the point: a click on a practice email is a lesson learned somewhere safe.

What to measure

It's easy to fixate on click rate, but on its own it can mislead. A harder lure gets more clicks than an easy one, so month-to-month numbers jump around for reasons that have nothing to do with your team. Look at a few things together:

• Clicked: useful as a trend over several months, comparing similar lures.
• Spotted and reported: the behaviour you actually want. More reports is a better sign than fewer clicks.
• Lessons completed: did the people who clicked read the 60-second lesson?
• Speed of reporting: in a real attack, the first report is what lets you warn everyone else.

Keep individual results private and use them to help, not judge. If one person clicks several times, a friendly chat and a little extra practice usually does more than anything formal.

That's the kind of programme Lureproof is built to run for small teams. It connects to Google Workspace or Zoho (Microsoft 365 is coming soon), sends each person a practice email at a random time during the working day, and turns a click into a 60-second lesson. Your dashboard shows who received, opened and clicked each campaign. It's free for up to five people, and our free security training is open to everyone.

FAQ