Phishing simulation and human-risk assessment
Phishing simulation to guide reporting and awareness improvements
Evaluate how employees report and respond to an approved simulated phishing campaign. ICA’s scoped assessment connects campaign findings and response metrics to practical improvement and training recommendations, without collecting real passwords.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Decide where awareness needs more attention
Your awareness program teaches employees to recognize suspicious messages. Security leadership also needs to understand what happens when a message reaches their inbox: whether people report it and how the organization responds.
This assessment is for CISOs, awareness leads, HR and IT security teams evaluating reporting and awareness effectiveness. An approved simulation creates a defined opportunity to observe those behaviors. Use the findings to decide where clearer guidance or training deserves attention. The campaign should support learning rather than label individual employees as security problems.
Define the audience and campaign boundaries
Scope begins with the participating employee groups and approved simulation content. Agree how the scenario relates to their work, which reporting route it exercises and what response activity will be evaluated. Excluded groups and sensitive operational periods belong in the campaign boundaries.
Leadership and HR approval are required before the campaign proceeds. Scope also establishes safeguards and data handling, including who may access results. The proposed infrastructure must comply with the relevant provider’s requirements. Real passwords and live credentials are excluded from collection. Any broader social-engineering activity needs its own explicit authorization and scope.
Observe reporting and response with agreed evidence
The engagement uses an authorized human-risk simulation. Before launch, agree the campaign objective, approved content and rules of engagement. Define what evidence the simulation can record and what client-held reporting or response evidence is needed. This avoids promising measurements that the selected infrastructure cannot support.
Review the agreed campaign events alongside the reporting and response activity available for assessment. Keep definitions consistent so the findings explain what was observed and where evidence is incomplete. Message difficulty and workplace context matter when interpreting outcomes; a response rate alone should not become a verdict on employee awareness.
This method differs from vulnerability scanning or penetration testing. It evaluates behavior within the approved scenario rather than proving that an attacker can compromise a system.
Turn campaign results into learning priorities
The catalog identifies three typical outputs, with detail agreed in the engagement scope.
Campaign findings explain the approved scenario, participating audience and observed outcomes. Leadership can use this account to understand the campaign’s coverage and the limits of its conclusions.
Response metrics summarize agreed reporting and response measures. Their definitions should make clear which events were counted and which participants or activities were covered. Awareness and security owners can use them to discuss where the reporting process needs attention.
Improvement and training recommendations connect findings to practical changes. Recommendations may address reporting instructions or learning needs revealed by the exercise. Use them to prioritize follow-up with the people responsible for awareness and security response. Training delivery and implementation are separately agreed work.
Prepare the approvals and operational context
Cost and timing depend on participant coverage, content review and the safeguards required for the campaign. Infrastructure permissions, evidence availability and data-handling arrangements also affect preparation. Those details need agreement before the engagement schedule can be confirmed.
Identify a leadership sponsor and HR contact, alongside the awareness and IT security owners who understand the reporting process. Prepare the proposed participant scope, relevant reporting instructions and any earlier campaign evidence that may inform the objective. Share only materials needed for the agreed assessment.
Client participation includes approving the content and authorization boundaries, confirming provider requirements and agreeing how results will be used. Escalation contacts and stop conditions should be clear before any simulated messages are sent.
Keep the exercise focused and proportionate
The simulation excludes employee shaming and collection of live credentials. Results should guide learning and process improvements within the approved data-handling arrangements. Coverage remains limited to the authorized participants and scenario; it does not establish resilience against every phishing approach or guarantee fewer incidents.
Separate assessments address other questions. A Microsoft 365 Security Configuration Assessment focuses on platform configuration under its own scope. An Incident Response & Ransomware Readiness Assessment addresses broader response planning. This campaign does not include configuration changes, emergency response or ongoing awareness operations. Additional campaigns and validation of improvements require separate agreement.
Phishing assessment questions
Who should consider this assessment?
Security and awareness leaders who need evidence about employee reporting and awareness effectiveness. HR participation helps establish appropriate safeguards and a learning-focused use of the results.
Will the campaign cover every employee?
Participant coverage is agreed during scoping. A selected audience can support a focused objective, but its results should not be presented as evidence for excluded groups.
What evidence will be evaluated?
The review uses agreed simulation events and available reporting and response evidence. Metrics depend on the selected infrastructure and access arrangements. The campaign collects no real passwords.
What affects cost and timing?
Audience size, content approvals, provider requirements and safeguards shape the work. Evidence access and client preparation also matter. Price and timing require a defined scope.
How does this differ from a penetration test?
This exercise observes human reporting and response in an approved scenario. Penetration testing evaluates exploitable technical weaknesses under separate authorization; it is outside this assessment’s scope.
Are training and corrective changes included?
The outputs include improvement and training recommendations. Delivering training, changing configurations and validating corrective actions require separate agreement. The client decides how to act on the findings.
Plan a simulation your team can learn from
Bring the reporting or awareness decision you need to make. Define an approved campaign around that objective, with clear safeguards and useful evidence. Campaign findings and response metrics can then guide practical learning priorities for your workforce and security team.
Decide where awareness needs more attention
Your awareness program teaches employees to recognize suspicious messages. Security leadership also needs to understand what happens when a message reaches their inbox: whether people report it and how the organization responds.
This assessment is for CISOs, awareness leads, HR and IT security teams evaluating reporting and awareness effectiveness. An approved simulation creates a defined opportunity to observe those behaviors. Use the findings to decide where clearer guidance or training deserves attention. The campaign should support learning rather than label individual employees as security problems.
Define the audience and campaign boundaries
Scope begins with the participating employee groups and approved simulation content. Agree how the scenario relates to their work, which reporting route it exercises and what response activity will be evaluated. Excluded groups and sensitive operational periods belong in the campaign boundaries.
Leadership and HR approval are required before the campaign proceeds. Scope also establishes safeguards and data handling, including who may access results. The proposed infrastructure must comply with the relevant provider’s requirements. Real passwords and live credentials are excluded from collection. Any broader social-engineering activity needs its own explicit authorization and scope.
Observe reporting and response with agreed evidence
The engagement uses an authorized human-risk simulation. Before launch, agree the campaign objective, approved content and rules of engagement. Define what evidence the simulation can record and what client-held reporting or response evidence is needed. This avoids promising measurements that the selected infrastructure cannot support.
Review the agreed campaign events alongside the reporting and response activity available for assessment. Keep definitions consistent so the findings explain what was observed and where evidence is incomplete. Message difficulty and workplace context matter when interpreting outcomes; a response rate alone should not become a verdict on employee awareness.
This method differs from vulnerability scanning or penetration testing. It evaluates behavior within the approved scenario rather than proving that an attacker can compromise a system.
Turn campaign results into learning priorities
The catalog identifies three typical outputs, with detail agreed in the engagement scope.
Campaign findings explain the approved scenario, participating audience and observed outcomes. Leadership can use this account to understand the campaign’s coverage and the limits of its conclusions.
Response metrics summarize agreed reporting and response measures. Their definitions should make clear which events were counted and which participants or activities were covered. Awareness and security owners can use them to discuss where the reporting process needs attention.
Improvement and training recommendations connect findings to practical changes. Recommendations may address reporting instructions or learning needs revealed by the exercise. Use them to prioritize follow-up with the people responsible for awareness and security response. Training delivery and implementation are separately agreed work.
Prepare the approvals and operational context
Cost and timing depend on participant coverage, content review and the safeguards required for the campaign. Infrastructure permissions, evidence availability and data-handling arrangements also affect preparation. Those details need agreement before the engagement schedule can be confirmed.
Identify a leadership sponsor and HR contact, alongside the awareness and IT security owners who understand the reporting process. Prepare the proposed participant scope, relevant reporting instructions and any earlier campaign evidence that may inform the objective. Share only materials needed for the agreed assessment.
Client participation includes approving the content and authorization boundaries, confirming provider requirements and agreeing how results will be used. Escalation contacts and stop conditions should be clear before any simulated messages are sent.
Keep the exercise focused and proportionate
The simulation excludes employee shaming and collection of live credentials. Results should guide learning and process improvements within the approved data-handling arrangements. Coverage remains limited to the authorized participants and scenario; it does not establish resilience against every phishing approach or guarantee fewer incidents.
Separate assessments address other questions. A Microsoft 365 Security Configuration Assessment focuses on platform configuration under its own scope. An Incident Response & Ransomware Readiness Assessment addresses broader response planning. This campaign does not include configuration changes, emergency response or ongoing awareness operations. Additional campaigns and validation of improvements require separate agreement.
Phishing assessment questions
Who should consider this assessment?
Security and awareness leaders who need evidence about employee reporting and awareness effectiveness. HR participation helps establish appropriate safeguards and a learning-focused use of the results.
Will the campaign cover every employee?
Participant coverage is agreed during scoping. A selected audience can support a focused objective, but its results should not be presented as evidence for excluded groups.
What evidence will be evaluated?
The review uses agreed simulation events and available reporting and response evidence. Metrics depend on the selected infrastructure and access arrangements. The campaign collects no real passwords.
What affects cost and timing?
Audience size, content approvals, provider requirements and safeguards shape the work. Evidence access and client preparation also matter. Price and timing require a defined scope.
How does this differ from a penetration test?
This exercise observes human reporting and response in an approved scenario. Penetration testing evaluates exploitable technical weaknesses under separate authorization; it is outside this assessment’s scope.
Are training and corrective changes included?
The outputs include improvement and training recommendations. Delivering training, changing configurations and validating corrective actions require separate agreement. The client decides how to act on the findings.
Plan a simulation your team can learn from
Bring the reporting or awareness decision you need to make. Define an approved campaign around that objective, with clear safeguards and useful evidence. Campaign findings and response metrics can then guide practical learning priorities for your workforce and security team.