Run a fair, useful phishing awareness pilot in 30 days
A downloadable pilot plan: a day-by-day 30-day timeline, three progressively realistic campaign designs, a metrics scorecard and a manager playbook. Set a baseline, train the people who click, and report results leadership can act on. Works with any simulation platform or a manual approach.
$300
Get the pilot plan — $300 Want it run for you?What's inside
How to use this plan
The rules of a pilot that improves reporting behaviour instead of shaming people: agreeing terms with HR and leadership, and telling staff simulations will happen (without dates).
Preparation checklist (days 1–5)
- Written approval and rules on individual results
- Scope, groups, exclusions and headcount
- Platform setup, allow-listing, reporting button tested
- Just-in-time training page and baseline survey
Three campaign designs
- Campaign 1: broad baseline
- Campaign 2: targeted by role (finance, HR, IT)
- Campaign 3: realistic vendor or internal-tool impersonation
- Lure themes, difficulty cues, landing behaviour and success measures for each
Metrics scorecard
- Delivered, opened, clicked, credentials entered, reported
- Median time to first report
- Repeat clickers and training completion
- Headline finding and highest-risk group
Manager playbook
- What to say before campaigns
- What to do when a team member clicks
- How to handle repeat clickers supportively
- Talking points for team meetings
Days 27–30: report and next steps
- Scorecard completed with trends described
- Aggregate results shared with leadership
- Technical follow-ups logged
- Quarterly cadence and training refresh planned
- Action plan page to capture your next three moves
The 30-day timeline
| Days | Phase | Key actions |
|---|---|---|
| 1–5 | Prepare | Approvals, scope, platform setup, allow-listing, baseline survey |
| 6–12 | Campaign 1: broad baseline | Generic lure to all; measure click and report rates |
| 13–19 | Campaign 2: targeted | Role-relevant lures (finance, HR, IT) |
| 20–26 | Campaign 3: realistic | Brand or vendor impersonation, credential page |
| 27–30 | Report and decide | Scorecard, manager briefings, next-quarter plan |
Fairness rule built into the plan: never use lures about pay cuts, layoffs, bonuses or health matters. They damage trust and are unfair to staff.
How it works
Checkout takes a minute. The PDF download link appears on the order confirmation and in your email.
Work through the preparation checklist, agree the rules and set up your reporting mechanism.
Follow the campaign designs, fill in the scorecard after each one, and use the manager playbook with your team leads.
Complete the scorecard, brief leadership on aggregate results and agree the next-quarter cadence.
Questions
Do I need a specific simulation platform?
No. The plan is platform-neutral and works with any phishing simulation tool or a manual approach.
What format is it?
A 9-page PDF pilot plan with fillable checklists, a campaign design table, a metrics scorecard, a manager playbook and an action-plan page.
Is this a managed service?
No. This is a self-serve plan for running your own pilot. If you would rather have continuous simulation and training run for you, see our Phishing Awareness Training program.
Is this a substitute for a security assessment?
No. The material is for education and internal planning. Test any configuration, rule or policy in a non-production environment first. It is not a substitute for a professional security assessment or legal review.