To run phishing training for staff, first measure risk with a baseline simulation, then set up a simple way to report suspicious emails. Next, deliver a short live session on modern tactics like AI-generated lures and QR codes, run fair simulations regularly, and report results as organization-wide totals without naming individuals.
Why Does Phishing Training Matter for Your Staff?
Phishing training matters because phishing is where most serious attacks begin. Abnormal Security's 2025 report found that phishing is the starting point for nearly 77% of advanced attacks. If your staff can spot and report a bad email, many of those attacks stop before they start.
The pressure is also growing. KnowBe4 reported a 17.1% increase in phishing attacks following the second half of 2025. Both figures come from security vendors, so treat them as directional, not exact. They still point the same way: more attempts are reaching inboxes.
Lures have also changed, and old advice about spotting bad grammar no longer holds. Training only works when it is a structured program that people practice, not a box you tick.
This guide breaks that program into five steps, in the order a team actually does them:
Measure: Run a baseline simulation before any training.
Report: Give staff one obvious way to flag suspicious email.
Teach: Hold a short live session on modern tactics.
Practice: Run fair, realistic simulations on a regular schedule.
Share results: Report organization-wide totals without naming anyone.
None of the steps needs a large team. Each one builds on the last, and the program is easier to defend to leadership when you can show progress from a measured starting point.
Step 1: How Do You Measure Your Starting Risk With a Baseline Simulation?
Run one realistic phishing simulation before you teach anything. That single test gives you the starting point you will compare every later result against. Without it, you cannot show that training changed behavior.
Keep the baseline simple:
Pick one believable lure: Choose a common scenario, such as a shared-document notice or a delivery alert. Avoid anything tied to pay, bonuses, or job security.
Send it to everyone at once or in small random groups: This keeps the sample fair and stops staff from warning each other.
Let it run for several days: Some people read email late, so a short window undercounts activity.
Record the results: Do not train anyone yet, and do not announce the test in advance.
Staff behavior is usually riskier than leaders assume. A 2024 Proofpoint survey found that 71% of working adults admitted to performing risky security actions. Proofpoint sells security products, so read the figure as vendor-reported. It is still a good reminder not to expect a clean result.
Here is what to record from the baseline:
Click rate: The share of people who clicked the link.
Report rate: The share who flagged the email as suspicious.
Silent rate: The share who never opened it. These people are neither safe nor at risk yet, so track them separately.
For example, if you send the test to 100 people and 18 click, 6 report, and 40 never open it, you have your baseline. Your click rate and your report rate, and the gap between them, are what you aim to move.
Report these as team or company totals only. You do not need to record who clicked, and keeping names out of the baseline protects the trust you need for the next steps. If you are looking for a current 2025 phishing training guide, this is the part that matters most: measure first, then teach.
Step 2: Set Up a Simple Way to Report Suspicious Emails
Staff can only report what they know how to report. Give everyone one obvious method, and make it quicker than deleting the email or forwarding it to a colleague.
Choose the option that fits your setup:
A report button: If your email platform supports an add-in, install a one-click "Report phishing" button in the toolbar.
A single shared address: Create an address such as security@yourcompany.com and tell people to forward anything odd. It works for any email system.
A chat channel: For small teams, a dedicated channel where people post a screenshot can work, as long as someone checks it daily.
Whichever you choose, write a short reporting policy. One page is enough. It should say what to report (anything unexpected that asks for a login, payment, or urgent action), how to report it, and what happens next. Share it at onboarding and pin it where people will find it.
Then answer every report. A quick reply, even just "Thanks, we checked and it's safe," tells people their effort was worth it. If reports vanish into silence, people stop sending them.
Most important, never punish someone for reporting, and never punish someone for clicking. Employees who fear blame hide mistakes, and a hidden click is far more dangerous than a reported one. Treat reports as the behavior you want more of. Thank people publicly for good catches, and treat a late report as better than no report.
Do this before your live session in Step 3. Teaching people to spot phishing without a place to send it leaves them with nothing to do with what they learned.
Step 3: Deliver a Short Live Session on Modern Phishing Tactics
Hold one live session of 30 to 45 minutes, in person or on video, and keep it practical. A live format lets people ask questions and see real examples, which a recorded course rarely manages. Use screenshots of actual suspicious emails, with names and details blurred.
Cover modern tactics in plain terms:
AI-generated lures: Messages can now read as polished and personal. A clean writing style is no longer a sign of a safe email, so teach people to judge the request, not the grammar.
QR codes: A code in an email or on a printed notice hides the web address. Staff should treat it like any unknown link and scan only when they expected it.
Urgency cues: Phrases like "within the hour" or "your account will be closed" push people to act before thinking.
Impersonation: Attackers copy a manager, a supplier, or a bank. Teach people to confirm unusual requests through a second channel, such as a phone call.
Close the session by walking through your reporting method from Step 2, so staff leave knowing exactly what to do. By the end, staff should be able to:
Pause on any email that asks for a login, payment, or quick action.
Hover over a link, or check a sender address, before clicking.
Verify unexpected requests through a separate channel.
Report anything unsure using the method you set up.
Keep the tone supportive. Staff are your first line of defense, and the goal is confidence, not fear. Record a short version for new hires so everyone gets the same message.
Step 4: How Often Should You Run AI-Powered Phishing Simulations?
Run simulations on a regular schedule, and monthly is a practical starting point for most teams. This is a recommendation, not a proven standard. Pick a rhythm you can keep up, because a steady cadence matters more than a perfect one.
Vary the lures so people learn the habit, not one trick. Rotate between link clicks, attachments, QR codes, and fake login pages. Send to random groups on different days so staff cannot predict or warn each other.
Set ethical guardrails before you launch. Fair simulations do not use high-stress emotions. Avoid lures about payroll changes, bonuses, redundancy, or layoffs, because they cause real distress and damage trust. Stay with everyday scenarios such as a parcel notice, a shared file, or a password reminder.
An AI-powered approach cuts the workload. Instead of writing every email by hand, the platform generates realistic messages and can adjust difficulty by person or team. If you want to compare options, tools like KnowBe4 and Proofpoint use AI to select simulations, convert real attacks into templates, or set learning paths from user risk data. Neither lists its pricing publicly, so you will need to request a quote.
For African businesses that want automation without a heavy setup, Riskspot, a human risk management platform, offers AI-powered phishing simulations. It runs the campaigns automatically and assigns training to the people who need it, so you spend less time scheduling.
For context, phishing simulations made up 37.8% of the security training and awareness market in 2024, according to Mordor Intelligence. That shows how common they are, not that they reduce clicks, so judge your own program by its results.
After each simulation, send a short, friendly note to everyone with the lesson, such as which warning signs were present. Do this whether people clicked or not.
Step 5: What Metrics Should You Report to Leadership Without Shaming Individuals?
Report organization-wide totals and trends, never names. Leaders need to know whether risk is falling, and staff need to know the program is safe. Both goals are met with aggregate numbers.
Click rate alone is a weak measure. A low click rate can mean people are careful, or it can mean the test was easy. Pair it with reporting behavior, which shows whether staff are actively helping. Use this table to decide what to track:
Metric | What It Tells Leadership | How to Use It |
|---|---|---|
Click rate | How many people fell for a lure | Compare to your baseline; expect it to fall over time |
Report rate | How many people flagged the email | Aim for this to rise; it shows engagement and trust |
Time to report | How fast staff raise the alarm | Shorter times mean threats are contained sooner |
Repeat-clicker trend | Whether the same group keeps clicking | Offer extra support to the group, not punishment to people |
Share results with staff too. A short monthly note such as "Reports are up, clicks are down" builds momentum and shows the program is working for everyone.
If someone clicks repeatedly, handle it privately and constructively. Offer a short refresher or a conversation about what made the lure convincing. Public lists and penalties push people to hide mistakes, which makes your numbers worse and your risk higher.
For board-level reporting, a platform that rolls these metrics into a single score saves time. Riskspot is a human risk management platform that runs phishing simulations, assigns training, and reports results for businesses, and its human risk reporting turns this data into board-ready summaries, which helps when you need to show progress without listing individuals.
How Do You Run Phishing Training With a Small Team and Limited IT Staff?
You can run phishing training with a small team by keeping the program light and automating the repeatable parts. A business with 30 people and one part-time IT contact should not copy an enterprise rollout. It should run the same five steps at a smaller scale.
Here is how the two situations differ:
Small teams: Do the baseline once, hold one live session, and run one short simulation each month. One person can own the reporting inbox. Skip complex learning paths.
Enterprises: Segment by department or role, set different difficulty levels, and track results by region. The work usually needs dedicated staff. SANS research cited by Swif puts the figure at a minimum of 2.8 FTEs (full-time equivalents) to change behavior at scale. That is a vendor-cited estimate for large organizations, not a target for a small business.
Your tooling choice comes down to time versus cost. Doing it manually or with open-source tools costs little in licenses, but you write the emails, schedule the sends, and compile the results yourself. Commercial platforms handle that work, which suits teams with no spare hours. Enterprise vendors such as KnowBe4 and Proofpoint do not publish pricing, so expect to request a quote.
Riskspot uses per-user pricing on an annual commitment, with Starter and Business tiers. The pricing calculator shows an example of 300 users at $450 per month, billed annually at $5,400 per year, which is about $1.50 per user per month. The calculator covers 1 to 500 users, and larger teams get a custom quote. A 14-day free trial is available with no credit card required, so you can run your baseline before you commit. See the Riskspot pricing page for current tiers.
Prices and plan limits verified as of November 2026.
FAQs
Does phishing training actually work?
Training works best as an ongoing program, not a single event. Measure a baseline, teach staff, practice with fair simulations, and track reports, and you build evidence from your own results. Watch for a falling click rate and a rising report rate over several months. That pattern shows behavior is changing, which matters more than any general claim.
How much does phishing training software cost?
Costs vary widely. Some vendors, including KnowBe4 and Proofpoint, do not list pricing publicly, so you must request a quote. Riskspot lists per-user pricing on an annual commitment. Its calculator example shows 300 users at $450 per month, about $1.50 per user per month, and it offers a 14-day free trial with no credit card.
Can a small business with no dedicated IT team run phishing training?
Yes. Run a baseline simulation, set up one reporting address, hold a short live session, and send a monthly simulation. One person can manage this in a few hours each month. An automated platform reduces the workload further by scheduling campaigns and assigning follow-up training for you.
Are free or open-source phishing simulation tools good enough?
They can be, for small teams with time and some technical skill. You get the basics of sending test emails, but you build the lures, schedule the campaigns, and compile reports yourself. If you lack those hours, a commercial platform saves effort and gives cleaner reporting. Match the tool to the time you actually have.
What should you do when an employee clicks a simulated phishing link?
Show a brief, friendly teaching page immediately, explaining which warning signs were present. Do not name or punish the person. Offer a short refresher if the same group keeps clicking. Treat the click as a learning moment, because staff who feel safe admitting mistakes also report real threats faster.
What are the ethical limits for phishing simulation templates?
Avoid lures that exploit high-stress emotions, such as payroll changes, bonuses, redundancy, or layoffs. These cause real distress and erode trust. Use everyday scenarios instead, like a parcel notice, a shared document, or a password reminder. Never publish individual results, and tell staff in your policy that simulations are part of the program.
Conclusion
Phishing training works when you treat it as a repeatable program: measure your starting risk, give staff an easy way to report, teach modern tactics, practice with fair simulations, and share results as totals without naming anyone. Done this way, even a small team can build steady, measurable improvement.
Start this week by running a baseline simulation and setting up one reporting address. Write down your click and report rates, then pick a monthly date for the next simulation so the habit sticks.
