Phishing Simulation for Businesses: How to Test Your Employees (+ Costs)

More than 90% of all cyberattacks start with a phishing email. One wrong click by one employee is enough to let ransomware in, steal login credentials or set a multi-million-euro attack on your organisation in motion. Security awareness training is part of the solution, but training without testing is like a driving test without any practical lessons. That's why more and more small and mid-sized businesses are turning to phishing simulations: controlled, realistic test emails that teach employees to spot the warning signs before the real threat actors get their turn. In this article we explain how a phishing simulation works, why it works, what it costs and how to get started.

What exactly is a phishing simulation?

A phishing simulation is a controlled exercise in which an IT specialist or Managed Security Service Provider sends fake phishing emails or text messages to a company's employees. These messages look just like real attacks: an invoice from a "supplier", a Microsoft login page, a courier trying to deliver a parcel, or even an email that appears to come from the managing director.

The goal isn't to trick employees, but to measure:

• What percentage click the link?
• Who enters their login details on the fake page?
• Who reports the email to IT as they should?
• How much time passes between receiving the email and reporting it?

Afterwards, employees who took the bait immediately get a short training session or an explanation of what went wrong. Those who did recognise the email get positive feedback. That turns a potentially embarrassing moment into a valuable learning opportunity.

Why does a phishing simulation work better than training alone?

Security awareness is a popular topic, but traditional online training has a major problem: people click through the slides, tick the box and forget it all within a week. A phishing simulation takes a different approach.

1. Learning in the real working environment

Training takes place in a separate environment. A phishing simulation lands in the same inbox as real emails. That's exactly the context in which things can go wrong, and therefore exactly the context in which you want people to learn.

2. Measurable results

You get concrete figures: 22% of the team clicks, 6% enters their details, 8% reports it properly. You can then measure whether those figures improve after training. This is measurable cybersecurity instead of gut feeling.

3. Behavioural change instead of knowledge transfer

Research by KnowBe4 shows that companies running monthly phishing simulations for a year reduce their "click rate" from an average of 27% to 3-5%. That's 5 to 9 times fewer successful attacks.

4. Meets compliance requirements

For businesses that fall under NIS2, ISO 27001 or DORA, demonstrable security awareness training is mandatory. A phishing simulation programme automatically produces the documentation you need to present during an audit.

Examples of phishing simulation scenarios

The best campaigns vary in complexity and context. Some realistic examples:

• The "Your Microsoft 365 password is expiring" email: one of the most commonly used scenarios, and it always catches part of the team.
• The fake invoice from a well-known supplier: with a PDF you shouldn't open or a "click here to pay" button.
• CEO fraud: an email that appears to come from the managing director, asking you to transfer money urgently or buy a gift card.
• The DHL/PostNL delivery notice: "Your parcel could not be delivered, click here to arrange a new delivery".
• The LinkedIn connection request: with a link to a fake login page.
• Smishing (phishing by text message): realistic because more and more attacks come through mobile channels.

A good partner starts with simple emails and raises the difficulty as employees improve. The scenarios become increasingly sophisticated, all the way up to AI-generated phishing that is impossible to tell apart from the real thing with the naked eye.

What does a professional phishing simulation programme look like?

A good approach consists of six steps:

1. Baseline measurement: an initial campaign without prior warning, to establish an honest baseline.
2. Analysis: which departments are most vulnerable? Which scenarios work best? Which employees report well?
3. Tailored training: employees who took the bait get a short, targeted training session. Not as a punishment, but as a learning opportunity.
4. Follow-up campaigns: a new simulation every 4-6 weeks with different scenarios, gradually becoming harder.
5. Reporting to management: a monthly overview of the "phish-prone percentage" and the improvement over time.
6. Annual evaluation: is the policy effective? Does the approach need adjusting?

Important: tell your team in advance that a simulation programme is coming. Not the exact emails or dates, but the fact that it's going to happen. This stops people feeling ambushed and fosters an open culture around cybersecurity.

What does a phishing simulation cost in 2026?

As with other security services, the price depends on company size and the number of campaigns. Typical rates:

• One-off simulation (basic): €500-€1,500 for a company with up to 50 employees
• Annual programme (4-6 campaigns): €1,800-€4,500 per year for a company with up to 50 employees
• Complete security awareness programme (phishing simulation + e-learning + reporting): €8-€18 per employee per month

For a company with 40 employees, that works out at €320-€720 per month. Compare that with the average cost of a successful phishing attack (€150,000-€250,000 including ransomware, reputational damage and downtime) and the ROI is crystal clear. Read more about cybersecurity budgets in what cybersecurity costs for SMEs.

5 common mistakes with phishing simulations

1. Publicly shaming employees

If someone clicks during the simulation, don't share it openly in a meeting. It creates fear rather than a willingness to learn. Feedback should always be personal and constructive.

2. Too many or too few campaigns

A test once a year has hardly any effect. But weekly tests are overkill and lead to "phishing fatigue". The sweet spot is one campaign every 4-6 weeks.

3. Always using the same type of email

If every simulation looks like a Microsoft email, people only learn to recognise that one type. Vary the sender, tone, language and platform (email, text message, Teams message).

4. No link to training

A simulation without follow-up training is a measuring tool without improvement. Make sure every click or wrong action automatically triggers a short learning module.

5. No "report" button in Outlook

Employees need to be able to report suspicious emails easily. Install a "Report phishing" button in Outlook that creates a ticket with your IT partner or SOC. This is a standard part of good security awareness training.

Which businesses benefit from a phishing simulation?

The short answer: virtually every business with more than 5 employees. But for some sectors it's practically mandatory:

• Law firms: high confidentiality, valuable data, obligations set by the Netherlands Bar (NOvA)
• Healthcare organisations: sensitive patient data, NEN 7510 compliance (the Dutch healthcare information security standard)
• Financial service providers: DORA compliance, high risks
• Accountancy firms: access to client data, frequently targeted
• All businesses under NIS2: an explicit obligation to provide security awareness training

Conclusion

A phishing simulation is one of the most effective and affordable measures you can take to make your organisation more resilient against cyberattacks. It works because it measures and changes real behaviour, and because it reflects how people actually deal with email in practice. Combine it with modern endpoint security, MFA and a solid backup strategy, and you have the foundation for strong cyber resilience.

Want to know how vulnerable your team is to phishing? Request a no-obligation phishing simulation or call our cybersecurity specialists directly on +31 85 303 5869. Within two weeks you'll have a concrete baseline and know exactly where the risks lie, without putting your employees on the spot.