Phishing Drills: How to Run One That Actually Trains Your Team

Now ask the question that never makes it onto that slide: the last time a real phishing email landed in someone's inbox, how many minutes passed before anyone told IT?

That second number is the one that protects your firm. Most phishing programs never measure it.

What is a phishing drill? A phishing drill, also called a phishing simulation, is a controlled fake phishing message sent to employees so they can practice spotting and reporting real attacks. A drill that actually trains your team measures how fast people report suspicious messages, not just who clicks, and pairs results with brief coaching and strong technical safeguards.

Why Don't Most Phishing Drills Change Behavior?

Because most are built to catch people, not to coach them.

The best recent evidence comes from a study of more than 19,500 employees at UC San Diego Health over eight months. Researchers found no meaningful link between completing annual security training and avoiding phishing clicks. The short lessons shown right after someone clicked a simulated link reduced future clicks by only about 2%. Three out of four employees spent a minute or less on that training page, and roughly a third closed it without engaging at all.¹

Two other findings stand out. The lure mattered enormously: a fake password-update email fooled 1.82% of recipients, while a fake vacation-policy update fooled 30.8%. And by the eighth month, more than half of employees had clicked at least one simulated link.¹

In other words, your click rate says as much about the email you chose as it does about your people. And given enough attempts, almost anyone will click eventually. That's not a failure of your team. It's a signal that clicks are the wrong finish line.

For a practice manager or managing partner, this is frustrating. You're paying for training, checking the compliance box, and still can't say with confidence that your team would catch the real thing. It shouldn't work that way. Employees were never meant to be the only safeguard, and a drill program that treats them like suspects makes them less likely to speak up when it counts.

Why Does This Matter for Compliance-Focused Firms?

People remain at the center of most breaches. Verizon's 2026 Data Breach Investigations Report found a human element in 62% of breaches, rising to 65% in financial and insurance organizations. Phishing accounted for 16% of initial access, and in simulations, voice and text message attacks drew a median success rate 40% higher than email.²

Regulators expect you to address this. The FTC Safeguards Rule requires covered financial institutions to provide security awareness training to staff, and the HIPAA Security Rule requires a security awareness and training program for covered entities.³ Cyber insurers ask, too. Our breakdown of cyber insurance renewals in 2026 covers what underwriters want to see.

Here's the opportunity: a well-run drill program produces evidence. A year of trend data showing faster reporting is far more persuasive to an auditor, an insurer, or a client than a stack of course completion certificates.

How Do You Run a Phishing Drill That Actually Trains Your Team?

Follow these seven steps. None require a large security team, and most can start this quarter.

1. Define the behavior you want before you write the email

The goal is not "nobody clicks." The goal is "suspicious messages get reported in minutes." Make sure every employee has a one-click Report Phishing button in Outlook or their mail client, and that reports go somewhere a person or automated tool actually reviews them.

2. Announce the program, not the date

Tell your team that drills will happen throughout the year and explain why. Transparency builds trust; surprise "gotchas" breed resentment and silence. Include leadership in the drills, and say so. Executives and finance staff are prime targets, and their participation shows the program is about protecting the firm, not policing employees.

3. Build lures from your real-world risk

Generic "your package is delayed" emails teach generic lessons. Mirror the messages your firm actually receives:

• Law firms: an e-signature request on a document that looks like a pending matter
• Healthcare practices: a payer portal notice or a patient records request
• Financial services: a vendor or client asking to update wire instructions

Vary difficulty across the year, and include at least one text message or phone-based scenario, since those channels are where attackers are getting more traction.

4. Coach in 30 seconds, not 30 minutes

If most people spend under a minute on a training page, design for that. When someone clicks, show a short landing page with the two or three red flags they missed and how to report next time. Short and specific beats long and generic.

5. Make the reporter the hero

Recognize fast reporters by name in a team meeting or internal channel. When reporting earns praise, it becomes a habit, and habits are what kick in when a real attack arrives at 4:45 on a Friday.

6. Coach repeat clickers privately

A handful of people will click more often than others. Handle it with a short, supportive one-on-one, not public shaming or automatic discipline. Often the root cause is workload, role (accounts payable sees more invoice lures), or simply unclear reporting steps.

7. Close the loop with technical controls

Drill data shows you where people need backup. Phishing-resistant multi-factor authentication (a second login step that a stolen password alone can't pass), strong email filtering, and password managers that only autofill on legitimate sites all catch what humans miss. The UC San Diego researchers reached the same conclusion: technical controls deliver a better return than training alone.¹ For more on building that layered approach, see our guide to turning employees into a human firewall.

What Should You Measure Instead of Click Rate?

Click rate isn't useless. It's just incomplete. Track these together:

Time to first report is the most important number on that list. If someone reports a real phishing email within two minutes, your IT team or partner can pull it from every other inbox before most people ever see it.

Where Do Phishing Drills Fit in the Technology Maturity Model?

At Sentry, we guide growing firms through the Technology Maturity Model (TMM), a four-stage roadmap: Operate, Secure, Integrate, Innovate. Phishing drills live in the Secure stage, but they only work when the Operate foundation is solid (current mail systems, MFA everywhere, a working report button).

Mature programs also reach into Integrate. Reports feed directly into your incident response process, drill results inform which roles need extra protection, and the trend data flows into compliance documentation and insurance renewals. That's the difference between a drill that checks a box and one that strengthens the whole firm.

We see the same pattern across professional services, healthcare, and financial firms: the businesses that improve fastest stop asking "who failed?" and start asking "how fast did we catch it?"

What Does Success Look Like?

It's a Tuesday morning. A convincing invoice email hits twenty inboxes at 9:14. By 9:16, three people have hit Report. By 9:20, it's gone from every mailbox. Nobody panicked, nobody got blamed, and the person who reported first gets a shout-out at the next staff meeting.

Your compliance file holds a year of improving trend data. Your insurance questionnaire takes minutes instead of days. And your team sees security as something they're part of, not something done to them.

Cybersecurity Awareness Month is a natural time to start. If you're mapping out the rest of October, our Cybersecurity Awareness Month field guide gives leaders a week-by-week plan.

Frequently Asked Questions

How often should we run phishing drills?

Monthly is a strong cadence for most firms, and quarterly is a reasonable minimum. Vary the timing, the lure, and the difficulty so employees build judgment rather than learning to recognize the test.

Should employees be disciplined for clicking a simulated phishing email?

Generally, no. Discipline for a single click discourages reporting, which is the behavior you most need. Reserve escalation for repeated risky behavior that persists after coaching, and handle it privately with HR.

Do phishing drills satisfy HIPAA or FTC Safeguards training requirements?

They support compliance but usually aren't enough on their own. Both rules call for a broader awareness program, and documentation matters. Confirm specifics with your compliance advisor, and keep records of each campaign and its results.

Are there lures we should avoid?

Yes. Realistic is good, but lures about layoffs, bonuses, or benefits changes can damage trust even when they work. Get HR's input on sensitive themes before launching them.

Do we need special software to run phishing drills?

Not necessarily. Many Microsoft 365 business plans with Defender for Office 365 Plan 2 include attack simulation training, and dedicated platforms exist as well. The tool matters less than the program design, measurement, and follow-through around it.

Ready to See How Your Team Would Respond?

You don't need to become a security expert to build a team that catches phishing fast. You need a clear plan, the right safeguards, and a partner who has walked other growing firms through it.

Not sure where your security gaps are? Schedule a free security audit. [PLACEHOLDER LINK]

References

1. Ho, G., Mirian, A., Luo, E., et al. "Understanding the Efficacy of Phishing Training in Practice." IEEE Symposium on Security and Privacy, 2025. https://sysnet.ucsd.edu/~voelker/pubs/phishtrain-oakland25.pdf. Summary: UC San Diego Today, September 17, 2025. https://today.ucsd.edu/story/cybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams
2. Verizon Business. 2026 Data Breach Investigations Report, Executive Summary. https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
3. FTC Standards for Safeguarding Customer Information, 16 CFR 314.4(e), https://www.ecfr.gov/current/title-16/part-314; HIPAA Security Rule, 45 CFR 164.308(a)(5), https://www.ecfr.gov/current/title-45/section-164.308