{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/phishing-simulation","url":{"en":"https://atlas.maintz.dev/en/terms/security/phishing-simulation/","da":"https://atlas.maintz.dev/da/terms/security/phishing-simulation/"},"term":{"en":"Phishing simulation","da":"Phishing-simulering"},"aka":{"en":["phishing test","simulated phishing campaign"],"da":["phishing-test","phishing-kampagne"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":2008,"summary":{"en":"Sending staff harmless fake phishing mails to see who clicks and to teach them to spot the real thing.","da":"At sende medarbejderne harmløse falske phishingmails for at se, hvem der klikker, og lære dem at genkende de ægte."},"body":{"formal":{"en":"A planned training exercise in which an organisation sends realistic but safe phishing messages to its own staff, measures how many click or report them, and follows up with short lessons.","da":"En planlagt træningsøvelse, hvor organisationen sender realistiske, men ufarlige phishingbeskeder til sine egne medarbejdere, måler, hvor mange der klikker eller melder dem, og følger op med korte lektioner."},"plain":{"en":"Like a fire drill for the inbox - practising the right reaction while nothing is really burning.","da":"Som en brandøvelse for indbakken - man øver den rigtige reaktion, mens intet brænder."},"inPractice":{"en":"The IT security officer at an audit firm sends a fake “You have new digital post” mail; staff who click see a friendly page pointing out the warning signs they missed.","da":"Den IT-sikkerhedsansvarlige i et revisionsfirma sender en falsk mail om, at “Du har fået ny digital post”; de, der klikker, ser en venlig side, der peger på de advarselstegn, de overså."},"whyItMatters":{"en":"It turns awareness into a number that can be followed over time and gives safe practice before a real attacker tests people - as long as it is used to teach rather than to shame.","da":"Det gør awareness til et tal, der kan følges over tid, og giver sikker øvelse, før en rigtig angriber prøver folk af - så længe det bruges til at lære og ikke til at udstille nogen."}},"deepDive":{"en":"A simulation platform - commercial suites, Microsoft Defender for Office 365 Attack Simulation Training, or the open-source GoPhish - sends templated messages with per-recipient tracking tokens embedded in links, attachments or QR codes, and records opens, clicks, credential submissions, attachment opens and reports. Typical payload types mirror real techniques: credential harvest, malware attachment, link in attachment, drive-by URL and OAuth consent grant. Because production defences would otherwise block or detonate the mails, third-party simulations must be explicitly exempted, in Microsoft 365 via the advanced delivery policy rather than blanket transport-rule bypasses, and link scanners must be accounted for, since sandbox detonation produces false clicks that inflate results.\n\nResults are only comparable when difficulty is controlled. The NIST Phish Scale (introduced in 2020, user guide NIST TN 2276, 2023) rates a template by counting observable cues (sender, formatting, technical and content anomalies) and assessing premise alignment, how well the pretext fits the recipient's actual work. A low-cue, high-alignment lure will produce far higher click rates than a clumsy one, so a falling click rate may reflect easier templates, not better staff. Report rate and time-to-report are more robust, and the difference between the two gives a picture of both susceptibility and detection. Small departments, one-off campaigns and seasonal effects add noise that is easily mistaken for trend.\n\nThe empirical evidence is sobering. Lain, Kostiainen and Čapkun (IEEE S&P 2022), with more than 14,000 employees over 15 months, found that embedded training shown after a click did not make employees more resilient and could make them more susceptible, while crowd-sourced reporting worked. Ho et al. (IEEE S&P 2025), in a randomised experiment with about 19,500 staff at UC San Diego Health, found no significant relationship between recent annual training and failure rates, and that most users spent a minute or less on embedded training pages. Simulations are thus better used to exercise reporting and to find processes that fail than as proof that training works.\n\nDesign and governance matter. Lures offering bonuses, pay rises or pandemic information have caused well-publicised staff backlash, for example at GoDaddy in 2020, and erode trust in the security team. Click data is personal data about employees, so under GDPR the programme needs a lawful basis (usually legitimate interest, Art. 6(1)(f)), transparent information to staff, data minimisation and, preferably, aggregated reporting to management rather than named lists. NIST SP 800-50 Rev. 1 places simulations under experiential learning alongside tabletop and cyber-range exercises, and CIS Controls v8 Control 14 expects training on recognising social engineering attacks.","da":"En simuleringsplatform - kommercielle pakker, Attack Simulation Training i Microsoft Defender for Office 365 eller open source-værktøjet GoPhish - sender skabelonbaserede beskeder med sporingstokens pr. modtager indlejret i links, vedhæftninger eller QR-koder og registrerer åbninger, klik, indtastede loginoplysninger, åbnede vedhæftninger og meldinger. De typiske nyttelaster spejler rigtige teknikker: høst af loginoplysninger, vedhæftet malware, link i vedhæftning, drive-by-URL og OAuth-samtykke. Da produktionsforsvaret ellers ville blokere eller detonere mailene, skal simuleringer fra tredjepart undtages eksplicit, i Microsoft 365 via advanced delivery policy frem for generelle omgåelser i transportregler, og der skal tages højde for linkscannere, fordi sandbox-detonering giver falske klik, der puster resultaterne op.\n\nResultater kan kun sammenlignes, når sværhedsgraden er styret. NIST Phish Scale (introduceret i 2020, brugervejledning NIST TN 2276 fra 2023) vurderer en skabelon ved at tælle synlige spor (afvigelser i afsender, formatering, teknik og indhold) og vurdere premise alignment, altså hvor godt påskuddet passer til modtagerens faktiske arbejde. Et lokkemiddel med få spor og høj relevans giver langt højere klikrater end et klodset et, så en faldende klikrate kan skyldes lettere skabeloner og ikke bedre medarbejdere. Meldeprocent og tid til melding er mere robuste mål, og forskellen mellem de to giver et billede af både modtagelighed og detektion. Små afdelinger, enkeltstående kampagner og sæsonudsving giver støj, der let forveksles med en tendens.\n\nDen empiriske viden er nedslående. Lain, Kostiainen og Čapkun (IEEE S&P 2022) fulgte over 14.000 ansatte i 15 måneder og fandt, at indlejret træning vist efter et klik ikke gjorde medarbejderne mere modstandsdygtige og endda kunne gøre dem mere modtagelige, mens fælles indrapportering virkede. Ho m.fl. (IEEE S&P 2025) fandt i et randomiseret eksperiment med omkring 19.500 ansatte på UC San Diego Health ingen signifikant sammenhæng mellem nylig årlig træning og fejlrate, og at de fleste brugte et minut eller mindre på de indlejrede træningssider. Simuleringer bruges derfor bedre til at øve indrapportering og finde processer, der svigter, end som bevis på, at træningen virker.\n\nDesign og governance betyder meget. Lokkemidler med bonusser, lønstigninger eller pandemi-information har skabt meget omtalt modstand blandt medarbejderne, fx hos GoDaddy i 2020, og undergraver tilliden til sikkerhedsteamet. Klikdata er personoplysninger om medarbejderne, så efter databeskyttelsesforordningen kræver programmet et behandlingsgrundlag (typisk legitim interesse, art. 6, stk. 1, litra f), gennemsigtig information til medarbejderne, dataminimering og helst aggregeret rapportering til ledelsen frem for navnelister. NIST SP 800-50 Rev. 1 placerer simuleringer under erfaringsbaseret læring sammen med tabletop- og cyber range-øvelser, og CIS Controls v8 Control 14 forventer træning i at genkende social engineering-angreb."},"howTo":{"steps":{"en":["Decide the purpose first - practising reporting and finding weak processes, not catching people - and get written approval from management, HR, employee representatives and the DPO.","Tell staff in advance that simulations will run, why and how the data is used, and document the GDPR lawful basis (usually Art. 6(1)(f)) and a retention period for click data.","Before the first campaign, make reporting easy with a report button and a quick, thankful reply to everyone who reports, whether the mail is real or simulated.","Build lures from threats you actually see, rate their difficulty with the NIST Phish Scale, and avoid cruel pretexts such as bonuses, pay rises or health scares.","Allow the simulation through your mail filters the supported way (for example the advanced delivery policy in Microsoft 365) and filter out clicks made by link scanners.","Run small campaigns spread over the year with varied templates instead of one big blast that staff warn each other about.","Follow every campaign with a short, friendly explanation of the warning signs and praise for those who reported, and never name or punish individuals.","Report aggregated report rate, time to report and click rate per difficulty level to management, and fix the processes that failed, such as invoice approval."],"da":["Fastlæg først formålet - at øve indrapportering og finde svage processer, ikke at fange folk - og få skriftlig godkendelse fra ledelse, HR, medarbejderrepræsentanter og DPO.","Fortæl medarbejderne på forhånd, at der kommer simuleringer, hvorfor og hvordan data bruges, og dokumentér behandlingsgrundlaget (typisk art. 6, stk. 1, litra f) og en slettefrist for klikdata.","Gør det let at melde før første kampagne, med en meldeknap og et hurtigt, anerkendende svar til alle, der melder, uanset om mailen er ægte eller simuleret.","Byg lokkemidlerne på trusler, I faktisk ser, vurdér sværhedsgraden med NIST Phish Scale, og undgå urimelige påskud som bonusser, lønstigninger eller helbredsbekymringer.","Lad simuleringen komme igennem mailfiltrene på den understøttede måde (fx advanced delivery policy i Microsoft 365), og frasortér klik fra linkscannere.","Kør små kampagner fordelt over året med skiftende skabeloner i stedet for én stor udsendelse, som medarbejderne advarer hinanden om.","Følg op på hver kampagne med en kort, venlig forklaring af advarselstegnene og ros til dem, der meldte, og udstil eller straf aldrig enkeltpersoner.","Rapportér samlet meldeprocent, tid til melding og klikrate pr. sværhedsgrad til ledelsen, og ret de processer, der svigtede, fx godkendelse af fakturaer."]},"pitfalls":{"en":["Using the click rate alone as the measure of success without controlling for how hard the templates were.","Naming, shaming or disciplining staff who click, which destroys trust and makes people stop reporting.","Lures that exploit pay, bonuses or personal worries and cause a backlash against the security team.","Running simulations without telling staff or employee representatives and without a GDPR basis for the click data."],"da":["At bruge klikraten alene som succesmål uden at tage højde for, hvor svære skabelonerne var.","At udstille, skælde ud på eller sanktionere medarbejdere, der klikker, hvilket ødelægger tilliden og får folk til at holde op med at melde.","Lokkemidler, der spiller på løn, bonusser eller personlige bekymringer og skaber modvilje mod sikkerhedsteamet.","At køre simuleringer uden at informere medarbejdere eller medarbejderrepræsentanter og uden et behandlingsgrundlag for klikdata."]},"guides":[{"title":"Phishing attacks - defending your organisation","url":"https://www.ncsc.gov.uk/guidance/phishing","publisher":"NCSC UK","tier":"official-doc"},{"title":"NIST TN 2276 - NIST Phish Scale User Guide","url":"https://csrc.nist.gov/pubs/tn/2276/final","publisher":"NIST","tier":"standard"},{"title":"Get started using Attack simulation training","url":"https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started","publisher":"Microsoft","tier":"official-doc"},{"title":"Film om god sikkerhedsadfærd","url":"https://sikkerdigital.dk/myndighed/uddannelse-og-awareness/film-om-god-sikkerhedsadfaerd","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"security/phishing","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/awareness-programme","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/phishing","why":{"en":"Staff who have practised spotting fake mails are less likely to fall for real ones and more likely to report them.","da":"Medarbejdere, der har øvet sig i at spotte falske mails, falder sjældnere for de ægte og melder dem oftere."},"confidence":"medium","strength":"primary"},{"type":"mitigates","to":"security/smishing","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-awareness","why":{"en":"Simulations are one of the main tools and measures in an awareness programme.","da":"Simuleringer er et af de vigtigste værktøjer og målepunkter i et awareness-program."},"confidence":"high","strength":"primary"}],"depth":3,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 2","tier":"course-material"},{"title":"CIS Controls v8 - Control 14 (Security Awareness and Skills Training)","tier":"standard","publisher":"Center for Internet Security"},{"title":"NIST TN 2276 - NIST Phish Scale User Guide","url":"https://csrc.nist.gov/pubs/tn/2276/final","tier":"standard","publisher":"NIST"},{"title":"Lain, Kostiainen, Čapkun - Phishing in Organizations - Findings from a Large-Scale and Long-Term Study (IEEE S&P 2022)","url":"https://arxiv.org/abs/2112.07498","tier":"other","publisher":"arXiv"},{"title":"Ho et al. - Understanding the Efficacy of Phishing Training in Practice (IEEE S&P 2025)","url":"https://people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf","tier":"other","publisher":"IEEE"}],"draft":true}