Corporate Phishing Exercise: A Complete Planning Guide for Security Teams (2026)

A phishing exercise — also called a phishing drill or phishing simulation — is a controlled test where your security team sends realistic fake phishing emails to your own employees. The goal: find out who clicks before an attacker does, and train those employees immediately at the moment of failure.

This guide covers every step of planning and running a corporate phishing exercise, from getting written sign-off to presenting results to leadership.

Before you start: get written authorisation

This is the step most teams skip — and the one that creates problems later. Before sending a single phishing email, get explicit written approval from:

• Senior leadership — CEO, CISO, or whoever owns cyber risk for the organisation
• HR — they will receive complaints from employees who clicked and feel targeted
• Legal or compliance — required if you're in a regulated industry (banking, healthcare, insurance)

The authorisation document should cover: the date range of the exercise, which employees are being tested, what data is collected, how results will be used, and confirmation that the simulation is authorised. Keep this document — you'll need it when someone escalates.

Step 1: Define your objectives

Know what you're measuring before you design the campaign. Common objectives for a first corporate phishing exercise:

• Baseline click rate — what percentage of your team is currently susceptible? Most organisations see 20–35% on their first simulation.
• Department comparison — is Finance more vulnerable than IT? Results by department tell you where to focus training resources.
• Credential submission rate — the subset who clicked and then typed their username and password into the fake login page. This is your highest-risk cohort.
• Template difficulty calibration — start with a medium-difficulty scenario. An obvious fake tells you nothing; an impossible spearphish demoralises employees unfairly.

Step 2: Set up your sending domain

The domain you send from determines whether phishing emails reach inboxes. You have two options:

• Your actual company domain (e.g. [email protected]) — most realistic, highest inbox placement rate
• A lookalike domain (e.g. [email protected]) — tests whether employees check the sender domain carefully

Either way, you need three DNS records on your sending domain: SPF, DKIM, and DMARC. In PhishSpark, go to Domains → Add Domain. The wizard generates all three records with copy-paste values. Add them in your DNS provider (Cloudflare is recommended — changes propagate in seconds), then click Verify. The platform checks all three records automatically.

This takes 10–15 minutes including DNS propagation on Cloudflare.

Step 3: Build your phishing template

Choose a scenario that's realistic for your organisation. The highest-performing templates in corporate phishing exercises:

• IT security alert: password expiry — "Your Microsoft 365 password expires in 24 hours." Nearly universal — every company uses Microsoft or Google.
• Payroll update required — "Your salary for this month is ready. Update your bank details to ensure timely payment." Highest credential submission rate of any scenario.
• Shared document notification — "[Manager name] has shared a file with you." Uses a familiar workflow; harder to spot.
• VPN certificate expiry — "Your remote access certificate expires tonight." Effective in remote-first or hybrid companies.
• HR benefits enrollment — "Annual open enrollment closes Friday. Log in to confirm your selections." Urgency with a real deadline feel.

In PhishSpark, go to Templates → New Template. Write your subject line and fill in the HTML editor with your email content. Use these variables — PhishSpark replaces them per recipient at send time:

• {{FIRST_NAME}} — personalises the greeting with the recipient's first name from your CSV
• {{PHISH_LINK}} — the HMAC-signed tracking link unique to each recipient; this is the link employees click in the email
• {{TRACKING_PIXEL}} — a 1×1 invisible image for email open tracking; paste at the bottom of the HTML body

Step 4: Upload your target list

Go to Target Lists → New List and upload a CSV. Required column: email. Recommended additional columns: first_name, last_name, department, position.

Including the department column is important — PhishSpark's reports break down click rates by department, so you can see that Finance has a 38% click rate and IT has 6%, and prioritise training accordingly.

For a first exercise, consider testing one or two departments before going company-wide. This lets you refine your template and process at smaller scale before committing to a full rollout.

Step 5: Whitelist the simulation IP in your email gateway

This step is frequently skipped — and it ruins results. Most corporate email environments route inbound mail through security gateways (Microsoft Defender for Office 365, Zscaler, Proofpoint, Mimecast, Barracuda) that automatically click every link in every email to check for malware.

If you don't whitelist before launch, these bots will click your phishing tracking links, inflating your click rate to 80–100% before a single human reads the email. Your data will be meaningless.

Add PhishSpark's sending IP (48.217.201.137) to your gateway's allowlist or URL-safe-scanning exclusion list before launching. PhishSpark displays this IP in the Domain Settings page. Your gateway admin console will have a "trusted senders" or "safe link exclusion" section — add the IP there.

Step 6: Create the campaign and launch

Go to Campaigns → New Campaign. The step-by-step wizard guides you through:

1. Select your email template
2. Select your target list
3. Select your verified sending domain, set a sender name and sender email address
4. Optionally schedule a send time (or send immediately)
5. Review and launch

Timing matters. Sending Tuesday–Thursday between 9am–11am (employees' local time) produces the highest open and click rates — and therefore the most representative data. Avoid Friday afternoons; too many people are context-switching out of careful email reading.

Step 7: Monitor results in real time

The PhishSpark dashboard updates in real time as events come in. You'll see three events per recipient:

• Email opened — detected via tracking pixel. Note: many modern email clients block remote images, so open rate is always an undercount of who actually read the email.
• Link clicked — the reliable metric. Each link is cryptographically signed (HMAC-SHA256) per recipient. If someone forwards the email and a colleague clicks it, that click does not count against the original recipient — so your data is accurate.
• Credentials submitted — the employee reached the phishing landing page and entered their username and password. This is your highest-risk cohort. The landing page shows them an immediate training message at this point.

Leave the campaign running for 48–72 hours before pulling results. Some employees check email infrequently. Cutting results at 24 hours under-counts your vulnerable population.

Step 8: Analyse and report results

After the campaign window closes, go to Reports to see:

• Overall click rate and credential submission rate for the campaign
• Awareness score (calculated as 100 minus click rate) — a simple benchmark to track over time
• Department breakdown — which team is most at risk
• Risk tier breakdown: how many submitted credentials, clicked only, opened only, or had no interaction

Export raw results as CSV via Campaigns → View Results → Export CSV for inclusion in a security report to leadership. The export includes per-recipient click and submission status, suitable for targeted follow-up.

Step 9: Act on the results

• Employees who clicked or submitted: They already saw a training page when they clicked the phishing link — this is the most effective training moment. Follow up within 48 hours with a personal message or brief conversation. Not as blame, but as a debrief: "here's what you missed, here's why attackers use this."
• Department heads: Share the aggregated department click rate — not individual names. Let them own improving their team's score over the next quarter.
• Leadership: Present the awareness score and the improvement trend you'll create by running simulations quarterly. Frame it as risk reduction over time, not a blame exercise.

What does a good result look like?

Click rate	Interpretation	Recommended action
Under 10%	Above average for a first simulation	Increase template difficulty next campaign
10–25%	Typical — most organisations land here	Targeted training for teams over 20%
25–40%	High risk — significant proportion susceptible	Mandatory awareness training, monthly cadence
Over 40%	Very high risk	Urgent leadership briefing, immediate training programme

Credential submission rate under 5% is acceptable for a first exercise. Over 10% is a serious indicator that warrants immediate follow-up training.

Run your first corporate phishing exercise this week

Create a free PhishSpark account — the free tier covers 500 targets and one domain. You can complete all nine steps above and have your first campaign launched within 30 minutes of creating your account. No credit card required.

Need help writing the authorisation document or planning the exercise? Email [email protected].