domains / families / security / executing-phishing-simulation-campaign

executing-phishing-simulation-campaign

separate

'Executes authorized phishing simulation campaigns to assess an organization''s

When to use

• Measuring employee susceptibility to phishing attacks as part of a security awareness program
• Testing the effectiveness of email security controls (secure email gateway, DMARC, SPF, DKIM)
• Conducting the social engineering component of a red team exercise to gain initial access
• Establishing a baseline for phishing susceptibility before deploying security awareness training
• Validating that incident response procedures work when employees report suspicious emails

When not to use

• without explicit written authorization
• actual credential theft beyond authorized scope
• targeting individuals personally
• sending phishing emails causing psychological harm or legal liability

Skill page

Source