Key Takeaways
- Employees who feel tricked by simulations become security risks — they stop reporting real threats
- Post-incident trust repair requires specific communication scripts and immediate action
- Monthly simulations work better than quarterly, but only with proper ethical boundaries
- Reporting rate matters more than click rate for measuring real security improvement
- Legal compliance under GDPR and NIS2 requires documented consent frameworks
You ran a phishing simulation. An employee clicked. They discovered it was a test. Now HR has a complaint on file, the union rep wants a meeting, and two people have stopped reporting suspicious emails altogether — because they’re afraid of looking stupid again.
You didn’t mean for this to happen. But here’s the hard truth that most phishing simulation guides won’t tell you: the way most programmes are run virtually guarantees this outcome. Not because simulations are wrong, but because the rules that protect employee trust are the same rules that make simulations actually work.
According to a 2025 industry benchmarking report, 33.1% of employees click on simulated phishing links before any training. After 12 months of consistent simulation-based training, that figure drops by 86% to just 4.1%. The training works — when it doesn’t destroy trust first.
Why Do Phishing Simulations Trigger Employee Complaints?
The problem isn’t that employees are sensitive. The problem is that most simulation programmes accidentally recreate the workplace dynamics that make real phishing attacks successful in the first place.
When you send a fake redundancy notice or a fake bonus announcement, you’re not testing cybersecurity awareness. You’re testing whether people trust their employer enough to believe official communications. When that trust breaks, the security consequence is immediate and measurable.
Research from 2025 found that employees trained within the last 30 days are four times more likely to report suspicious emails than those trained earlier. But this only holds when the training relationship feels collaborative, not adversarial.
The moment a simulation crosses into what employees experience as surveillance or entrapment, they stop engaging with the security team entirely. This isn’t a morale problem. It’s a detection problem.
What Should You Do When a Simulation Has Already Backfired?
If you’re reading this because employees are already angry, here’s your immediate response protocol.
Step 1: Acknowledge Impact Within 24 Hours
Send an all-staff message that acknowledges the specific complaint without being defensive. Use this language framework:
“We’ve heard concerns that yesterday’s security exercise felt deceptive rather than educational. That wasn’t our intention, but impact matters more than intention. We’re reviewing our approach to ensure future exercises build security awareness without undermining workplace trust.”
Step 2: Meet With HR and Union Representatives
Don’t wait for them to schedule the meeting. Request it yourself. Bring specific changes you’re implementing, not just apologies. Focus on the security rationale: employees who distrust security exercises won’t report real threats.
Step 3: Implement a Cooling-Off Period
Suspend simulations for 30 to 60 days while you rebuild the programme framework. Use this time to establish the ethical boundaries and communication protocols that should have been in place from the start.
Which Simulation Scenarios Cross Ethical Lines?
The scenarios that generate the highest click rates are often the same ones that trigger formal complaints. Here’s the taxonomy that separates effective training from workplace manipulation.
Always Acceptable
- External service notifications (fake delivery alerts, fake social media notifications)
- Generic IT requests (password updates, software installations)
- Third-party vendor communications (fake invoices, fake contract updates)
- Industry news or conference invitations
Use With Extreme Caution
- Internal IT requests that could reasonably come from your actual IT team
- Customer or client communications in customer-facing roles
- Executive communications that don’t involve personal consequences
Never Acceptable
- Fake disciplinary notices or performance reviews
- Fake redundancy or layoff announcements
- Fake bonus or pay-related communications
- Fake medical alerts or health emergencies
- Fake legal notices or regulatory compliance requirements
The rule is simple: if the scenario exploits an employee’s genuine workplace anxieties or promises rewards the organisation cannot deliver, it crosses the ethical line from education into manipulation.
How Do You Communicate About Simulations Without Spoiling Them?
The biggest communication challenge is being transparent about the programme without making specific simulations predictable. Here’s the framework that works.
Programme Launch Communication
Send this message 30 days before your first simulation:
“Starting [date], we’re launching a security awareness programme that includes periodic phishing simulations. These are realistic but harmless test emails designed to help everyone recognise and report suspicious messages. The goal is building our collective defence against real attacks, not testing individual performance. If you receive a suspicious email — whether it’s a simulation or a real threat — please report it to [contact]. Questions about the programme can be directed to [contact].”
Ongoing Reinforcement
Every quarter, send a brief reminder that reinforces the educational purpose without revealing timing or content. Focus on what employees should do (report suspicious emails) rather than what they should avoid (clicking links).
What Legal Requirements Apply to Phishing Simulations?
Under GDPR, individual click data is personal data. Recording who clicked what requires a lawful basis — and employee consent is legally invalid due to the power imbalance between employers and staff.
The correct legal basis is legitimate interest, but this must be documented through a Legitimate Interest Assessment that weighs the business need against employee privacy rights.
For EU organisations, NIS2 (mandatory since October 2024) elevates phishing simulations from best practice to regulatory requirement. Auditors now require evidence of training effectiveness, not merely completion certificates.
Important: This constitutes general guidance only. Consult qualified legal counsel for advice specific to your jurisdiction and organisational structure.
How Often Should You Run Simulations?
Most security teams run simulations quarterly because that feels reasonable. The evidence supports monthly cadence instead.
A 2024 meta-analysis of 42 phishing simulation studies found that annual programmes are “unlikely to provide sustained protection.” Training effects decay significantly without reinforcement. The 2025 Data Breach Investigations Report confirmed that employees trained within 30 days show four times higher reporting rates.
Monthly simulations work when they follow ethical boundaries and maintain educational focus. The key is varying scenarios, difficulty levels, and delivery timing to prevent the “coffee machine effect” — employees warning each other the moment a simulation goes out.
Why Is Click Rate the Wrong Metric?
Click rate tells you who was curious or inattentive. Reporting rate tells you who would help defend the organisation against a real attack.
According to a 2024 industry report, only 18.3% of simulated phishing emails were properly reported by users. That’s the number that matters. In financial services, the reporting rate reaches 32.35% — showing that sector-specific training and clearer reporting processes work.
Present both metrics to leadership, but emphasise reporting rate improvement over click rate reduction. The goal is building a workforce that actively participates in threat detection, not one that passively avoids mistakes.
How Do You Handle Repeat Clickers?
Some employees consistently click on simulations regardless of training. This requires individual attention, but not individual blame.
Research from 2025 distinguishes between “stable individual heterogeneity” (persistent high-risk users) and “state dependence” (habit formation through training). The intervention depends on the cause.
The Dignified Response Protocol
- Private conversation focusing on real-world threat awareness, not simulation performance
- Skills-based support: demonstrate how to check sender addresses, hover over links, verify requests through alternative channels
- Environmental factors: assess whether job role, time pressure, or technical setup contribute to risk
- Reasonable adjustments: additional browser security, email filtering, or reporting shortcuts
Never frame this as disciplinary action. Frame it as targeted security support for someone in a higher-risk role or situation.
Does Phishing Training Actually Work?
This is the question security teams are afraid to ask because recent research has challenged the effectiveness of traditional approaches.
Studies from 2024 and 2025 found that embedded post-click training — immediate landing page feedback when someone clicks — can actually increase susceptibility through overconfidence effects. Annual e-learning programmes showed “negligible effects” on click rates across over 12,000 participants.
But sustained simulation programmes with targeted education halved compromise rates within six months across 20 organisations. The difference is in the implementation, not the concept.
Training works when it’s frequent, realistic, ethically bounded, and focused on building reporting behaviour rather than reducing click behaviour. It fails when it’s annual, generic, manipulative, or focused purely on individual performance metrics.
What Should You Do Next?
Start with trust, not technology. If your current programme has triggered complaints or resistance, pause and rebuild the ethical framework before running another simulation. The most sophisticated phishing simulation platform in the world won’t help if employees have stopped trusting the security team.
Focus on reporting rate as your primary success metric. Train employees what to do with suspicious emails, not just what to avoid. Make reporting easy, fast, and consequence-free.
Platforms like Complorer are built specifically for this challenge — combining realistic simulation capabilities with the ethical boundaries and trust-building features that prevent employee backlash while maintaining educational effectiveness.
Begin with clear communication about the programme’s purpose, implement ethical scenario boundaries, and measure success by how many employees actively help defend the organisation rather than how many passively avoid mistakes.
Frequently Asked Questions
Can you run phishing simulations without telling employees?
You should inform employees that simulations are part of your security programme without revealing specific timing or content. Complete secrecy often triggers complaints and may violate employment law or data protection requirements. Programme-level transparency builds trust while maintaining simulation effectiveness.
What happens if an employee refuses to participate in phishing simulations?
Document the refusal and explore the underlying concern through HR channels. Some employees may have legitimate reasons such as accessibility requirements or role-specific constraints. Focus on ensuring they understand how to report suspicious emails rather than forcing participation in simulations.
How do you prevent the coffee machine effect?
Stagger simulation delivery over several days or weeks rather than sending to all employees simultaneously. Use different scenarios for different groups. Some organisations send simulations to random subsets of employees rather than the entire workforce to maintain unpredictability.
Should you include executives in phishing simulations?
Yes, but with additional care around scenario selection and communication. Executives are high-value targets for real attacks and need security awareness training. However, simulations targeting executives require senior leadership buy-in and careful consideration of business impact and external reputation risks.
What’s the difference between phishing simulations and security awareness training?
Phishing simulations test behaviour through realistic scenarios, while security awareness training teaches knowledge through educational content. Effective programmes combine both: simulations identify knowledge gaps and behavioural patterns, while training provides the skills and context needed to recognise and respond to real threats.
References
[1] Verizon Business. (2025). 2025 Data Breach Investigations Report.
[4] UK National Cyber Security Centre. (2024). Phishing Attacks: Defending Your Organisation.
Buy on AWS Marketplace