Attack Simulation Training: Best Practices + Strategies 2024

Phishing campaigns remain a top concern for security teams worldwide...

3.4 billion malicious emails are sent every day.

And Verizon’s 2023 DBIR found that 36% of all data breaches involved phishing.

But what exactly is attack simulation training, and how does it work?

Below, we'll cover all the information you need to make an informed decision - the mechanics of phishing simulations, realistic results you can expect to achieve and how to get maximum value from your vendor.

Overview: what is attack simulation training?

📚 Quick definition: Attack simulation training is a proactive approach to cybersecurity education that involves simulating phishing attacks to train employees on how to recognize and respond to phishing emails.

Using simulated attacks that mimic real-world phishing attempts, allow security teams to assess employees' susceptibility to phishing and provide targeted training to improve their awareness and response.

The main goal of attack simulation campaigns to educate employees about the tactics used by bad actors, reduce the likelihood of falling victim to phishing scams, and strengthen the overall security posture of your organization.

Why do security teams use this kind of training?

Phishing attacks will usually target either your organization as a whole, or specific individuals (often C-level executives, directors, or managers).

Attackers will find and gather information on social media to create personalized  phishing attacks. 

And whilst some attackers are amateurs using more primitive methods, others are experts who will use sophisticated tactics to access your organization's sensitive information.

97% of companies have been the target of a sophisticated phishing attack...

And 90%of corporate security breaches are the result of email-based phishing attacks.

Want to create lasting behavior change? You need simulations

The data is clear: raising awareness alone just isn't effective.

This is why organizations use training that actually simulates malicious emails - so that employees get frequent practice dealing with realistic threats.

If you already have compliance-based training in place, you'll need to take this a step further to build a strong human firewall that can actually prevent and mitigate the impact of potential threats.

To change employee behavior in any measurable way, continuous practical training is needed.

No matter what filters you have in place, there will always be advanced email threats that manage to make their way to your employees' inboxes.

And without regular practice, employees won’t have the skills or confidence to catch them.

By simulating real threats in a controlled environment, you can give employees a feel for what these attacks look like in the wild... and start to form positive habits.

These habits aren't built overnight though.

So, at Hoxhunt we aim to send users at least 36 simulations a year (one every 10 days).

What kind of attacks can you simulate?

Phishing simulation training tests employees on a range of tactics commonly used in phishing attacks.

Here's what you can expect to simulate:

• Email spoofing: Simulating emails that appear to come from legitimate sources but are actually from malicious actors.
• Social engineering: Crafting persuasive messages that exploit human psychology to trick recipients into taking a specific action, such as clicking on a malicious link or providing sensitive information.
• Malicious attachments: Sending emails with attachments containing malware or ransomware disguised as legitimate documents, invoices, or software updates.
• Urgency and fear tactics: Creating a sense of urgency or fear in the email content to pressure recipients into responding quickly without verifying the legitimacy of the message.
• Deceptive links: Including hyperlinks in emails that lead to fake login pages, phishing websites, or malware downloads.

Essential attacks your training should cover

Spear phishing

How does it work?

These are targeted attacks where specific individuals receive personalized emails based on their roles, often containing payload email with phishing techniques like custom URLs or custom login pages.

How can you simulate this?

Use advanced phishing simulation platforms to craft realistic attack scenarios tailored to specific roles, incorporating custom notifications and built-in landing pages that mimic real attack methods.

Whaling

How does it work?

In whaling phishing attacks, high-level executives are targeted with emails that appear to be from colleagues or business partners, often requesting email requests for confidential information or financial transactions.

How can you simulate this?

Simulate these attacks with realistic attack scenarios aimed at executives, including real-world attacks like custom login prompts or custom landing pages that seem legitimate.

Vishing (voice phishing)

How does it work?

Attackers may use phone calls pretending to be IT support or other authorities, asking for sensitive information like passwords.

How can you simulate this?

Although less common in email-based tools, some providers will be able to simulation campaigns that incorporate voice phishing training.

Here at Hoxhunt, our training always you to produce custom deepfakes scams and clone the voice of one of your employees/executives.

Smishing (SMS phishing)

How does it work?

Targets are sent text messages containing phishing URLs or prompts to share personal information.

How can you simulate this?

Include smishing simulations as part of your overall phishing simulation overview, educating employees on how to identify suspicious text messages.

Clone phishing

How does it work?

In these kinds of attacks, cybercriminals replicate legitimate emails that users have received before, replacing links or attachments with malicious code.

How can you simulate this?

Recreate previous step emails using to replace links with phishing techniques.

If you want to make these easier/harder, simply adjust how close to the original the simulation email looks.

Pop-up phishing

How does it work?

Fake pop-ups appear on websites, often disguised as security alerts, leading users to phishing URLs.

How can you simulate this?

Simulate pop-up windows that appear while users are browsing, mimicking legitimate website prompts.

Make sure to go with a vendor that offers more than just simple email simulations.

Credential harvesting

How does it work?

Credential harvesting is a cyber attack that involves stealing user credentials (like usernames and passwords).

Users are directed to fake login pages designed to capture this information.

How can you simulate this?

Use built-in login pages or custom login prompts in simulations to educate employees on identifying legitimate versus fake login pages.

Here's how attack simulation training works

Planning and defining objectives

You'd typically begin by identifying what you're looking to achieve with phishing simulations.

This might involve assessing employees' susceptibility to phishing attacks or evaluating the effectiveness of existing security controls.

You can then determine the scope of your simulations - such as the number of participants, the frequency of simulations, and the types of phishing scenarios being tested.

Create your scenarios

Once you know what you're objectives are, you can then develop realistic simulated phishing emails specific to your industry, business processes, and common communication channels.

These scenarios may include email messages, text messages, or social media posts designed to mimic genuine communication from trusted sources.

Execute your simulations

Once your phishing scenarios are created, you'd then deploy these simulated phishing emails to targeted employees or groups within your organization.

Emails can be sent at predetermined times and can vary in complexity and sophistication to assess employees' ability to recognize and respond to different types of phishing threats.

Monitor and analyse results

Throughout the simulation period, you can monitor employees' responses to the phishing emails, tracking metrics such as open rates, click-through rates, and interaction with malicious links or attachments.

Any trends, patterns and areas of vulnerability you spot can be used to inform your cyber security awareness training initiatives.

Use results to inform your training and awareness

To get the most out of your simulations, you can use the results to feedback to employees on their performance and offer targeted training to address gaps in knowledge or behavior.

What is adaptive phishing training? And why does this approach work?

📚 Quick definition: Adaptive phishing training is a dynamic approach that tailors training content based on an individual’s performance and behavior during simulations (full transparency: this is how Hoxhubt works).

Instead of providing the same training to all users, adaptive phishing training adjusts the difficulty, frequency, and type of simulations based on how employees respond to previous attempts.

Employees can either be your greatest strength or your greatest weakness when it comes to cybersecurity...

And employees who aren't confident or motivated enough to spot and report attacks  pose a significant risk to your organization.

So, if an employee is struggling to catch simulations, an adaptive phishing attack simulation tool will send them easier attacks to build up their skills.

Once they're consistently spotting attack simulations, you can then slowly increase the difficulty level.

This personalized approach helps address specific vulnerabilities within your organization by making sure every employee is receiving training relevent to their job role, location and skill-level.

Does this approach product results?

Well, here's how an adaptive training approach can impact outcomes 👇

How to customize attack simulations to your organization

Identify the main threats your organization faces

To map your own unique threat landscape, assess the specific threats your industry and organization face.

The industry you're in will largely dictate the kinds of attacks you're most likely to face.

• Financial services: targeted using Business Email Compromise (BEC) where attackers impersonate executives to trick employees into transferring large sums of money or disclosing financial data.
• Retail: targeted using credential harvesting, an attack which involves sending phishing emails that mimic popular e-commerce platforms, designed to trick employees into entering login details on fake sites.
• Manufacturing: targeted using invoice phishing, where attackers send fake invoices that appear to be from trusted suppliers.

Segment your employees

Tailor simulations based on different user groups, such as executives versus general staff.

Breaking employees down into buckets will help address the varying levels of risk and exposure so that you can make simulations relevant for peoples roles.

Use historical data

Got data from previous simulations and real incidents?

Use this to craft more targeted and realistic scenarios that reflect actual threats your organization has faced.

If employees tend to miss specific types of attacks, you might want to double down on these to address any vulnerabilities.

Customize landing pages and follow-up training

Create custom landing pages and training materials that are specific to the type of phishing attempt simulated, ensuring users learn exactly where they went wrong and how to avoid future mistakes.

Attack simulation training best practices: how to maximize the impact of your training

Use a wide variety of simulations

You can use simulations to test employees on different types of real-world threats.

If you run into issues with employees downloading malicious attachments, you can  send out simulated attacks with attachments.

Or if they're clicking malicious links you can add a URL to the vector.

We'd generally recommend combining different types of attacks to test every possible scenario.

Continuously practice simulations

Practice makes perfect...

And so the more practice employees have, the better they will be able to spot suspicious emails.

Yearly or quarterly tests aren’t sufficient to tangibly change employee behavior. According to our own data here at Hoxhunt, running tests at least a few times a month is the most effective.

Give constructive feedback to employees

However employees perform, you need to provide them with feedback (be sure to let them know it was a simulation).

Strong security cultures aren't built on punishment and criticism.

Always use positive reinforcement and reward systems in your feedback if you want to increase the overall motivation and engagement of employees.

Beware of missed simulations

When companies first begin with Hoxhunt, they'll usually have a failure rate of 25%, a success rate of 4%, and the rest are missed.

Which is a pretty significant unknown when it comes phishing risks.

Neglected phishing simulations are the single biggest unknown in human risk.

Missed phishing simulation is not a good thing.

And although most traditional failure-focused training programs frame this a s a positive, our data tells us that high miss rates predict higher risk of a breach.

Failure rate doesn't tell you anything about your unknown risk (your employee's ability to spot and respond to a phishing attack).

So, we'd strongly recommend that you track these metrics too:

• Miss rate: The phishing simulations that they neglect for whatever reason.
• Success rate: The phishing simulations that are correctly reported
• Real threat reporting: The number of real phishing attacks- per-user that get reported
• Engagement rate: the proportion of the organization who are enrolled and participating

Integrating simulations with security awareness training

Reinforce learning with real-world scenarios

Use attack simulations to provide hands-on experience with the concepts taught in your security awareness training.

When employees encounter simulated phishing emails that mirror the threats discussed in their training, they can apply their knowledge in a controlled environment.

Tweak training based on simulation results

Analyze the outcomes of your simulations to identify areas where employees may need additional training.

For example, if a significant number of employees fall for a particular type of phishing email, you can customize follow-up training to address that specific weakness.

Give real-time feedback

When an employee successfully identifies and reports a simulated attack, provide immediate positive reinforcement - don't wait for the end of the month or quater.

This could be in the form of recognition or additional educational content that further empowers them to recognize phishing threats.

Track progress and compliance

Rather than being two distinct processes, use simulations as a metric to track employee progress in security awareness.

This data can also help ensure compliance with industry standards and regulations, providing evidence that your organization is actively working to reduce risk.

Results you can expect from using attack  simulations

Improve employee awareness and behavior

Attack simulation training raises employee awareness of phishing threats.

Studies show that 80% of organisations find that awareness training reduces the risk of falling for a phishing attack.

Reduce the effectiveness of real-life phishing attacks

Phishing simulation training will reduce the risk of successful phishing attacks by identifying and addressing vulnerabilities in employee behavior.

Research by the Aberdeen Group found that companies with attack simulation training in place experience a 50% decrease in successful phishing attacks.

Strengthen your security culture

Effective training will build a culture of security awareness within your organization, where employees become active participants in defending against cyber threats.

A report by the Ponemon Institute revealed that organizations with a strong security culture are 5.5x more likely to have well-defined security policies and procedures.

Stay compliant

Phishing simulation training helps organizations meet compliance requirements for security standards and regulations, such as GDPR and HIPAA.

Studies show that organizations using phishing simulation training programs are 70% more likely to meet compliance requirements for data protection regulations.

How to research training vendors

Before you start talking with with potential vendors, you'll want to create a list of questions and criteria.

Below are some of they key topics and questions we tend to get asked here at Hoxhunt...

User experience

• How do you encourage employees to participate in training?
• How much time will training take away from day-to-day work?

Personalization

• What language options do you have?
• What happens when an employee fails a phishing simulation?
• Does everyone receive the same training or is it personalized to employees?
• How often is the training content updated?

Reporting & metrics

• What type of progression can you expect to see after 1 month/ 6 months/ 1 year of training? (reporting rates, participation rates, etc.)
• What KPIs do you measure?
• What are the reporting capabilities do you offer?

Automation

• How much manual admin is required to send out a campaign to 100/ 10,000/ 20,000 employees?
• Where does malicious content (phish emails) go once it has been reported by an employee?

Implementation

• What does the onboarding process look like?
• Will I receive help with communication before the roll out of phishing training?
• Do you have threat reporting tools?
• Can the training be integrated with other tools? e.g. Microsoft ATP
• Does it work on all devices/ email clients?

🚨 Warning: inefficient training leads to errors

Security awareness training programs that don't require frequent practice leave employees with enough knowledge and skills to effectively avoid cyber threats.

Employees are the biggest attack surface for your organization.

And the more employees you have, the bigger the risk of attacks.

Employees that don't receive continuous practical training can become an enormous risk for your company.

What separates Hoxhunt from other solutions?

To measurably reduce human risk levels, your phishing training must focus on behavior change.

But how do you get employees to absorb learning materials?

And how can you actually engage them with practical simulations? 

Hoxhunt training simulates real phishing attacks and delivers interactive, bite-sized trainings that employees genuinely enjoy.

Only 3-5% of people report real cyber-attacks...

And Companies that contained a breach in less than 30 days saved more than $1 million compared to those that took more than 30 days.

Hoxhunt uses continuous engagement to increase reporting rates to 60-75%and failure rates down to a sustained 2%.

Here are some of the outcomes you can expect from using Hoxhunt's award-winning phishing simulation training:

• 20x lower failure rates
• 90%+ engagement rates
• 75%+ detect rates

‍

Case study: Avanade

Avanade is a global professional services company providing IT consulting and services focused on the Microsoft platform.

Industry: IT consulting

Headquarters: Seattle, WA and London, UK

Number of employees: 50,000+

The Challenge

Legacy security awareness training services were overly manual, did not integrate optimally with the Microsoft environment, and were not sufficiently lowering human risk.

The Results

• Resilience without resources: 5 FTEs of SOC analyst work saved per month with automated Response Platform
• Over 900 hours / month of SOC analysis saved
• Real threat reports up to tens of thousands per month
• Resilience ratio today is up 259% from baseline
• 98% reduction in false positives and incident escalations due to response platform
• Making sense of the threat feed and orchestrating Spam, legit email, threats, and incidents
• Over 50% reduction in spam reports

Attack simulation training FAQ

What is attack simulation training?

Attack simulation training involves sending simulated phishing emails to employees to assess their ability to recognize and respond to phishing attempts.

This helps identify vulnerable users and improve overall cybersecurity awareness.

How do these simulations work?

Simulations mimic real-world phishing tactics using custom payloads, phishing links, and simulated phishing messages.

They can include elements like malware attachments, drive-by URLs, and social engineering techniques.

Simulations are automated and can be customized to fit specific scenarios.

What are the benefits of simulation reports?

Simulation reports provide insights into user behavior, highlighting who clicked on phishing links or opened malware attachments. This data helps refine training and improve security posture.

What happens after a simulation?

After a simulation, users who fell for the phishing attempt are often directed to integrated security awareness training, where they learn how to recognize and avoid such attacks in the future.

How often should simulations be conducted?

Simulation training should be conducted regularly to reinforce cybersecurity awareness and ensure employees would be able to identify and report genuine threats.

Many organizations conduct phishing simulations on a monthly or quarterly basis, but the frequency may vary depending on your risk profile and compliance requirements.

Generally speaking, the more frequent they are the better.