sysop@hub:~/tools/phishing-drill-kit$

phishing-drill-kit

A phishing drill can teach a company to report in thirty seconds, or teach it to distrust its own IT. The difference is in how it is planned and how the results are used. This kit has the plan, three sample mails written for training, the text for the page people land on, and a fair way to count.

the plan, in order

When	What	Who
Three weeks before	Agree the goal with management in one sentence: "more people report, faster". Not "catch people".	IT, management
Three weeks before	Inform the works council or staff representatives and the data protection officer. In many countries this is required, everywhere it is wise. Agree that no names go to managers.	IT, HR
Two weeks before	Make sure reporting works: one button or one address, tested. A drill without a way to report measures nothing useful.	IT
Two weeks before	Tell everyone that exercises will happen "in the coming months", why, and that nobody gets into trouble. Announced drills still work.	Management
One week before	Set up the sending: allow the training sender in the mail filter so that it arrives, and test with two colleagues.	IT
The day	Send in waves over a morning, not to everyone at once, and not on a Monday, a Friday or in the week of the annual accounts.	IT
The same day	Thank everyone who reported, personally and quickly.	IT
One week after	Share the numbers for the whole company, what gave the mail away, and what changes now.	IT, management
Three months after	Repeat with another kind of mail. Compare reporting rate and time, not click rate alone.	IT

rules that keep the trust

No bait about pay, bonuses, layoffs, health or family. A fake bonus mail gets clicks and costs the goodwill of the whole company. Real attackers use these; you are not one.
No names to managers, no rankings, no punishment. Results are counted per company or per large department. Whoever clicked sees a short explanation, privately, and that is all.
Never collect real passwords. If the exercise has a sign-in page, it records that something was typed, not what.
The help desk and whoever is impersonated know in advance. If the mail pretends to come from the managing director, ask them first.
Do not imitate real outside companies. No bank, parcel service or supplier logos: that can be a trademark problem and puts their name on your trick. Invent the sender.
Easy first. The first drill should be one that attentive people spot. Success builds the habit; a mail nobody can spot teaches helplessness.
Reporting counts more than not clicking. Somebody who clicks and reports at once has done the most useful thing possible in a real attack.

three sample mails for training

Invented senders, with the signs written next to them. Change names and details to fit your company. They are for your own staff, with the preparations above.

FromIT Service Desk <helpdesk@it-support-portal.example>SubjectAction needed: your mailbox is almost full

Hello,

your mailbox has reached 96% of its storage. Incoming messages will be rejected from tomorrow.

Increase your storage here: https://mailbox-storage.it-support-portal.example/extend

IT Service Desk

What gives it away

The sender's domain is not the company's.
A deadline: tomorrow.
No name, no ticket number, no phone number to call back.
IT can enlarge a mailbox without the user signing in anywhere.

FromScanner 3rd floor <scanner@docs-share.example>SubjectScanned document for you (2 pages)

A document was scanned and sent to you.

Pages: 2. Sent by: Office.

Open the document

This link expires in 24 hours.

What gives it away

Nobody scanned anything for you.
The real scanner sends an attachment from an internal address, not a link.
"Expires in 24 hours" is there to stop you from asking a colleague.
The link text hides the address: hover to see it.

FromAnna Example (Managing Director) <anna.example.md@fastmail-private.example>SubjectAre you at your desk?

Hi, I am in a meeting and cannot talk. I need you to take care of something for me quickly and discreetly. Reply here, not by phone.

Sent from my phone

What gives it away

A private address with the director's name in front. On a phone, only the name shows.
"Cannot talk", "discreetly", "not by phone": every check is ruled out in advance.
No link and no attachment, so filters let it pass. The request for gift cards or a transfer comes in the second mail.
The defence is a rule, not a filter: money and account changes are confirmed by phone on a known number.

the page people land on

Short, kind, and useful in the ten seconds people give it.

That was an exercise.

The mail you just opened was sent by our IT team to practise spotting phishing. Nothing has happened to your computer or your account, and nobody is told who clicked.

Three things gave it away:

The sender's address was not one of ours.
It asked you to act today.
The link led to a different address than the text said. Hover over a link before you click, or press and hold it on a phone.

If this had been real: report it with the "Report" button in Outlook and call IT on 123. Reporting after a click is exactly right, and fast reporting has stopped real attacks here.

counting fairly

Number	What it tells you	Careful
Reported	The one that matters. In a real attack, the first report is what starts the defence.	Count reports to the button, to IT by phone and by forward.
Minutes until the first report	How long an attacker would have had.	The best single number to show management.
Clicked	How convincing this one mail was.	Mail scanners click links too. Subtract clicks within seconds of delivery and from data centre addresses. Never compare two drills with different mails by this number.
Entered something	How many would have given credentials away.	Small numbers: one person is several percent in a small company.
Clicked and reported	People who did the right thing after the wrong one.	Praise this group out loud.

afterwards

Tell the whole company the result within a week, with the mail on screen and the signs marked.
Fix what the drill showed on your side: no report button on phones, the external-sender tag missing, the help desk not knowing what to do with reports.
A drill does not replace the technical controls. Phishing-resistant sign-in stops the attack even when somebody clicks.
Put the reminder where people see it: the security posters have one on phishing and one on reporting.

Rules on monitoring employees differ by country and by company agreement: have the plan checked before the first drill. This text is not legal advice. Microsoft 365 with Defender for Office 365 Plan 2 includes attack simulation training; without it, a mail sent from a separate domain that you own and a simple web page do the job. Related: phish or legit to practise alone, phish analyzer for the real ones, mail header reader, incident plan builder, how AiTM phishing works, compromised account checklist.