# Employee Phishing Simulation Training Programme Phishing simulation is a controlled security exercise in which your employees receive realistic phishing emails created by your security team, designed to test whether they click malicious links, submit credentials, or correctly report the threat. Staff who interact with the simulated phishing receive immediate, contextual training. The programme runs continuously — measuring and improving your organisation's real-world phishing resilience over time. ## Why This Matters - **43%** of UK businesses experienced a cyber breach in 2025 (DSIT) - **85%** of breaches involved phishing (DSIT 2025) - **£3,550** average cost of a disruptive breach for UK businesses - **19,000** UK businesses hit by ransomware in the past year ## What's Included ### Step 1: Baseline Assessment The programme begins with a baseline simulation — a phishing email sent to all participants without advance warning. This establishes your current click rate, credential submission rate, and reporting rate, giving a clear picture of where you are starting from. ### Step 2: Simulation Campaign Design AMVIA designs a simulation campaign tailored to your business. Simulations are not generic — they reference your industry, tools, and use realistic sender names and branding. The goal is to test your staff. ### Step 3: Immediate Training for Clickers Staff who click a link, submit credentials, or open an attachment in a simulation receive immediate, contextual training — a short (two to three minute) learning module that explains what they just experienced, what the warning signs were, and what they should have done instead. ### Step 4: Targeted Follow-Up Training After each simulation cycle, AMVIA produces a report identifying which staff members clicked and which submitted credentials. Staff with repeated click-through behaviour receive targeted follow-up training. ### Step 5: Ongoing Simulation and Measurement The programme runs continuously — typically monthly or quarterly simulations of increasing sophistication. As staff become more capable, simulations become more targeted and technically convincing to continue developing their awareness. ## Cyber Insurance Cyber insurers increasingly require evidence of security awareness training, and many specifically ask about phishing simulation programmes. AMVIA's programme provides quarterly reports that demonstrate ongoing staff training, suitable for insurance renewal documentation. ## How We Run Your Phishing Programme From first simulation to security culture change — measurable results within 90 days. 1. **Programme Setup**: We configure your simulation platform, import your user list, and design phishing templates relevant to your industry. 2. **Initial Simulation**: A realistic phishing email is sent to all staff — measuring who clicks, who reports, and who enters credentials. 3. **Targeted Training**: Staff who fall for simulations receive immediate, contextual training — building awareness at the point of failure. 4. **Continuous Testing**: Monthly simulations with increasing sophistication, tracking improvement trends and identifying persistent risk areas. ## Why Choose AMVIA for Phishing Simulation ### Sheffield-Based, UK-Focused Our engineering and support team operates from Sheffield. We understand UK compliance requirements and the specific challenges facing British businesses. ### Accredited & Certified AMVIA holds Cyber Essentials Plus, ISO 27001, and Microsoft Gold Partner status — giving you confidence that our services meet the highest UK security and quality standards. ### 1,200+ UK Businesses Protected We manage IT and security for over 1,200 UK businesses across sectors including legal, finance, healthcare, and professional services. ## Frequently Asked Questions ### What is phishing simulation training? Phishing simulation training involves sending realistic, controlled phishing emails to employees to test whether they click malicious links or submit credentials. Staff who interact with the simulation receive immediate training. ### Is it ethical to send fake phishing emails to employees? Phishing simulation is a standard, widely accepted security practice. The purpose is to provide realistic, experiential training in a safe environment. ### How often should we run phishing simulations? Monthly simulations provide the best improvement trajectory. Quarterly simulations are sufficient for organisations with resource constraints. ### What happens if an employee repeatedly fails phishing simulations? AMVIA's reporting identifies persistent clickers. These individuals receive targeted, enhanced training. The programme is never punitive — the goal is improvement, not blame. ### Can phishing simulation be used to meet cyber insurance requirements? Yes. Most UK cyber insurers accept phishing simulation as evidence of security awareness training.