A phishing assessment is a controlled simulation of real-world phishing attacks, conducted with the organisation’s knowledge and consent. Its purpose is to measure how employees respond to phishing emails and to identify where the organisation’s human-layer defences need strengthening.

Unlike a real attack, a phishing assessment is designed to produce actionable data — not to compromise systems or steal credentials. The emails are realistic, but the infrastructure behind them is controlled by the testing team, and no actual harm results from an employee clicking a link or entering their password.

What a phishing assessment is not

A phishing assessment is not a gotcha exercise. The goal is not to catch people out or to compile a list of employees who “failed.” It is an organisational measurement: how resilient is this organisation to email-based social engineering, and where are the gaps?

The distinction matters. If employees fear punishment for clicking a link in a test, they will not report real phishing emails when they receive them. The assessment must be positioned as a learning exercise, not a disciplinary one.

Campaign types

Professional phishing assessments use a range of campaign types, each testing a different aspect of resilience.

Credential harvesting

The most common campaign type. Employees receive an email containing a link to a fake login page — often mimicking a familiar service such as Microsoft 365, Google Workspace, or an internal portal. If the employee enters their credentials, the page captures them (without storing them long-term or using them) and records the event.

This tests whether employees can identify a fraudulent login page and whether they will enter credentials without verifying the URL.

A simpler variant where the email contains a link, but no credential capture. The system records who clicked the link and when. This is useful as a baseline measurement or for testing awareness of suspicious links without the added complexity of a login page.

Attachment delivery

Employees receive an email with an attachment — a macro-enabled document, a PDF with an embedded link, or a file that simulates malware delivery. The system records who opened the attachment. This tests whether employees will open unsolicited attachments and whether endpoint security controls detect and block them.

QR code phishing (quishing)

An increasingly common vector. The email or a printed document contains a QR code that, when scanned with a mobile phone, directs the employee to a phishing page. This bypasses email link scanning because the URL is never present in the email body.

The phased approach

Effective phishing assessments use a phased, escalating approach rather than a single campaign.

Wave 1: Baseline. A broad campaign using a moderately convincing pretext, sent to all employees (or a representative sample). The pretext is generic — a password expiry notice, a delivery notification, or an IT system update. This wave establishes a baseline: what proportion of the workforce clicks and submits credentials without any recent training or priming?

Wave 2: Targeted. A more sophisticated campaign aimed at specific departments or roles. The pretext is tailored to the target — a finance team might receive a fake invoice, an HR team might receive a fake CV with an embedded link, and IT staff might receive a fake vulnerability alert. This wave tests whether higher-risk roles are more resilient than the general population.

Wave 3: Spear phishing. The most sophisticated wave. Individual emails are crafted for specific high-value targets — executives, finance controllers, IT administrators — using OSINT gathered from public sources. The pretext references real projects, colleagues, or events. This tests the resilience of the people who would be targeted by a real, determined attacker.

Each wave produces data that informs the next. If Wave 1 reveals a high baseline click rate, training can be delivered before Wave 2 to measure its impact.

Metrics that matter

A phishing assessment produces quantitative data across several dimensions.

Click rate. The percentage of recipients who clicked the link. This is the most commonly reported metric but is also the least informative on its own — a click without credential submission has limited impact.

Credential submission rate. The percentage of recipients who entered credentials on the phishing page. This is the metric that most directly corresponds to real-world risk.

Report rate. The percentage of recipients who reported the phishing email through the organisation’s designated channel (a “report phishing” button, a security team email address, etc.). This is arguably the most important metric, because a high report rate means the organisation can detect and respond to phishing quickly.

Time to first report. How quickly the first report was received after the campaign was launched. A fast first report allows the security team to warn the rest of the organisation and contain the campaign.

Repeat offenders. Individuals who click or submit credentials across multiple campaigns. This identifies people who may need additional, targeted training.

Segmentation. Results broken down by department, seniority, location, and campaign type. This reveals whether certain groups are more vulnerable than others and allows training to be targeted accordingly.

Turning results into improvement

The assessment report is the starting point, not the end. The value comes from what the organisation does with the data.

Targeted training. Departments or roles with high click or submission rates receive focused awareness training. This is more effective than blanket training because it addresses specific gaps.

Process improvements. If the assessment reveals that verification procedures are not being followed — for example, finance staff processing payment requests received by email without independent verification — this is a process issue, not just an awareness issue.

Technical controls. Assessment results may highlight gaps in email filtering (phishing emails reaching inboxes), endpoint security (malicious attachments not being blocked), or authentication (credentials being usable without MFA).

Benchmarking. Results from successive campaigns provide a trend line. Is the organisation getting better? Are specific interventions having an impact? Industry benchmarks provide external context.

Repeat testing. Phishing resilience is not a fixed state. Regular assessments — quarterly or biannually — maintain awareness and provide ongoing measurement. A single annual test is better than nothing, but attackers do not operate on an annual cycle.

What to look for in a phishing assessment provider

Not all phishing assessments are equal. Key considerations include:

  • Realistic pretexts. Generic, obviously fake emails do not test real-world resilience. The provider should craft pretexts that are relevant to the organisation and its sector.
  • Ethical approach. The assessment should be designed to measure and improve, not to shame. Results should be reported at an organisational level, not used to single out individuals.
  • Comprehensive reporting. Beyond raw numbers, the report should include analysis, context, and actionable recommendations.
  • Training integration. The best providers offer awareness training that is directly linked to the assessment results — “you clicked on this type of email, here is why it was suspicious and how to spot it next time.”
  • Flexibility. The ability to run multi-wave campaigns, target specific groups, and use a variety of campaign types (credential harvesting, attachment delivery, QR codes) rather than a one-size-fits-all approach.