{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/phishing-simulation","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/phishing-simulation/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/phishing-simulation/"},"term":{"en":"Phishing simulation","da":"Phishing-simulering"},"aka":{"en":["phishing test","simulated phishing campaign"],"da":["phishing-test","phishing-kampagne"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":2008,"summary":{"en":"Sending staff harmless fake phishing mails to see who clicks and to teach them to spot the real thing.","da":"At sende medarbejderne harmløse falske phishingmails for at se, hvem der klikker, og lære dem at genkende de ægte."},"body":{"formal":{"en":"A planned training exercise in which an organisation sends realistic but safe phishing messages to its own staff, measures how many click or report them, and follows up with short lessons.","da":"En planlagt træningsøvelse, hvor organisationen sender realistiske, men ufarlige phishingbeskeder til sine egne medarbejdere, måler, hvor mange der klikker eller melder dem, og følger op med korte lektioner."},"plain":{"en":"Like a fire drill for the inbox - practising the right reaction while nothing is really burning.","da":"Som en brandøvelse for indbakken - man øver den rigtige reaktion, mens intet brænder."},"inPractice":{"en":"The IT security officer at an audit firm sends a fake “You have new digital post” mail; staff who click see a friendly page pointing out the warning signs they missed.","da":"Den IT-sikkerhedsansvarlige i et revisionsfirma sender en falsk mail om, at “Du har fået ny digital post”; de, der klikker, ser en venlig side, der peger på de advarselstegn, de overså."},"whyItMatters":{"en":"It turns awareness into a number that can be followed over time and gives safe practice before a real attacker tests people - as long as it is used to teach rather than to shame.","da":"Det gør awareness til et tal, der kan følges over tid, og giver sikker øvelse, før en rigtig angriber prøver folk af - så længe det bruges til at lære og ikke til at udstille nogen."}},"deepDive":{"en":"A simulation platform - commercial suites, Microsoft Defender for Office 365 Attack Simulation Training, or the open-source GoPhish - sends templated messages with per-recipient tracking tokens embedded in links, attachments or QR codes, and records opens, clicks, credential submissions, attachment opens and reports. Typical payload types mirror real techniques: credential harvest, malware attachment, link in attachment, drive-by URL and OAuth consent grant. Because production defences would otherwise block or detonate the mails, third-party simulations must be explicitly exempted, in Microsoft 365 via the advanced delivery policy rather than blanket transport-rule bypasses, and link scanners must be accounted for, since sandbox detonation produces false clicks that inflate results.\n\nResults are only comparable when difficulty is controlled. The NIST Phish Scale (introduced in 2020, user guide NIST TN 2276, 2023) rates a template by counting observable cues (sender, formatting, technical and content anomalies) and assessing premise alignment, how well the pretext fits the recipient's actual work. A low-cue, high-alignment lure will produce far higher click rates than a clumsy one, so a falling click rate may reflect easier templates, not better staff. Report rate and time-to-report are more robust, and the difference between the two gives a picture of both susceptibility and detection. Small departments, one-off campaigns and seasonal effects add noise that is easily mistaken for trend.\n\nThe empirical evidence is sobering. Lain, Kostiainen and Čapkun (IEEE S&P 2022), with more than 14,000 employees over 15 months, found that embedded training shown after a click did not make employees more resilient and could make them more susceptible, while crowd-sourced reporting worked. Ho et al. (IEEE S&P 2025), in a randomised experiment with about 19,500 staff at UC San Diego Health, found no significant relationship between recent annual training and failure rates, and that most users spent a minute or less on embedded training pages. Simulations are thus better used to exercise reporting and to find processes that fail than as proof that training works.\n\nDesign and governance matter. Lures offering bonuses, pay rises or pandemic information have caused well-publicised staff backlash, for example at GoDaddy in 2020, and erode trust in the security team. Click data is personal data about employees, so under GDPR the programme needs a lawful basis (usually legitimate interest, Art. 6(1)(f)), transparent information to staff, data minimisation and, preferably, aggregated reporting to management rather than named lists. NIST SP 800-50 Rev. 1 places simulations under experiential learning alongside tabletop and cyber-range exercises, and CIS Controls v8 Control 14 expects training on recognising social engineering attacks.","da":"En simuleringsplatform - kommercielle pakker, Attack Simulation Training i Microsoft Defender for Office 365 eller open source-værktøjet GoPhish - sender skabelonbaserede beskeder med sporingstokens pr. modtager indlejret i links, vedhæftninger eller QR-koder og registrerer åbninger, klik, indtastede loginoplysninger, åbnede vedhæftninger og meldinger. De typiske nyttelaster spejler rigtige teknikker: høst af loginoplysninger, vedhæftet malware, link i vedhæftning, drive-by-URL og OAuth-samtykke. Da produktionsforsvaret ellers ville blokere eller detonere mailene, skal simuleringer fra tredjepart undtages eksplicit, i Microsoft 365 via advanced delivery policy frem for generelle omgåelser i transportregler, og der skal tages højde for linkscannere, fordi sandbox-detonering giver falske klik, der puster resultaterne op.\n\nResultater kan kun sammenlignes, når sværhedsgraden er styret. NIST Phish Scale (introduceret i 2020, brugervejledning NIST TN 2276 fra 2023) vurderer en skabelon ved at tælle synlige spor (afvigelser i afsender, formatering, teknik og indhold) og vurdere premise alignment, altså hvor godt påskuddet passer til modtagerens faktiske arbejde. Et lokkemiddel med få spor og høj relevans giver langt højere klikrater end et klodset et, så en faldende klikrate kan skyldes lettere skabeloner og ikke bedre medarbejdere. Meldeprocent og tid til melding er mere robuste mål, og forskellen mellem de to giver et billede af både modtagelighed og detektion. Små afdelinger, enkeltstående kampagner og sæsonudsving giver støj, der let forveksles med en tendens.\n\nDen empiriske viden er nedslående. Lain, Kostiainen og Čapkun (IEEE S&P 2022) fulgte over 14.000 ansatte i 15 måneder og fandt, at indlejret træning vist efter et klik ikke gjorde medarbejderne mere modstandsdygtige og endda kunne gøre dem mere modtagelige, mens fælles indrapportering virkede. Ho m.fl. (IEEE S&P 2025) fandt i et randomiseret eksperiment med omkring 19.500 ansatte på UC San Diego Health ingen signifikant sammenhæng mellem nylig årlig træning og fejlrate, og at de fleste brugte et minut eller mindre på de indlejrede træningssider. Simuleringer bruges derfor bedre til at øve indrapportering og finde processer, der svigter, end som bevis på, at træningen virker.\n\nDesign og governance betyder meget. Lokkemidler med bonusser, lønstigninger eller pandemi-information har skabt meget omtalt modstand blandt medarbejderne, fx hos GoDaddy i 2020, og undergraver tilliden til sikkerhedsteamet. Klikdata er personoplysninger om medarbejderne, så efter databeskyttelsesforordningen kræver programmet et behandlingsgrundlag (typisk legitim interesse, art. 6, stk. 1, litra f), gennemsigtig information til medarbejderne, dataminimering og helst aggregeret rapportering til ledelsen frem for navnelister. NIST SP 800-50 Rev. 1 placerer simuleringer under erfaringsbaseret læring sammen med tabletop- og cyber range-øvelser, og CIS Controls v8 Control 14 forventer træning i at genkende social engineering-angreb."},"edges":[{"type":"requires","to":"security/phishing","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/awareness-programme","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/phishing","why":{"en":"Staff who have practised spotting fake mails are less likely to fall for real ones and more likely to report them.","da":"Medarbejdere, der har øvet sig i at spotte falske mails, falder sjældnere for de ægte og melder dem oftere."},"confidence":"medium","strength":"primary"},{"type":"mitigates","to":"security/smishing","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-awareness","why":{"en":"Simulations are one of the main tools and measures in an awareness programme.","da":"Simuleringer er et af de vigtigste værktøjer og målepunkter i et awareness-program."},"confidence":"high","strength":"primary"}],"depth":3,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 2","tier":"course-material"},{"title":"CIS Controls v8 - Control 14 (Security Awareness and Skills Training)","tier":"standard","publisher":"Center for Internet Security"},{"title":"NIST TN 2276 - NIST Phish Scale User Guide","url":"https://csrc.nist.gov/pubs/tn/2276/final","tier":"standard","publisher":"NIST"},{"title":"Lain, Kostiainen, Čapkun - Phishing in Organizations - Findings from a Large-Scale and Long-Term Study (IEEE S&P 2022)","url":"https://arxiv.org/abs/2112.07498","tier":"other","publisher":"arXiv"},{"title":"Ho et al. - Understanding the Efficacy of Phishing Training in Practice (IEEE S&P 2025)","url":"https://people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf","tier":"other","publisher":"IEEE"}],"draft":true}