Choose one behavior and define what success looks like
A useful exercise asks whether the team can perform a specific safer action. Examples include finding the reporting contact, opening a known portal separately or holding an unverified supplier change. Avoid an objective as vague as catch every phishing message. Choose the workflow, the people who own it and the evidence that would show the handoff worked in the proposed scenario.
Write the success condition before presenting the message. For example, the recipient identifies the requested action, pauses it and sends a clear report to the designated owner. The owner then acknowledges the report and explains who can authorize the change. This makes the exercise about an observable process rather than guessing whether an employee was sufficiently suspicious or labeling them a security risk.
Start with a synthetic tabletop that needs no live deception
Prepare a fictional message using made-up organizations, non-operational destinations and invented transaction details. Ask participants what they would do, where they would find the trusted contact and what they would include in a report. Do not send the message as a real external campaign, collect credentials or require anyone to open a destination. The discussion can reveal missing owners without creating a new incident.
Our tabletop worksheet is a proposed exercise aid. It is not a commercial implementation of the NIST Phish Scale, a reproduction of its worksheets or a claim that a training session was delivered. Keep the scenario short enough for staff to explain the business action in plain language. Record the workflow gap and its owner instead of scoring an individual's personality or technical confidence.
| Field | Plan before the exercise | Useful observation |
|---|---|---|
| Objective | One action, such as verify a supplier change. | Can participants explain the intended safe action? |
| Scenario | Invented message and non-operational details. | Does the request resemble relevant work? |
| Owner and deputy | Who receives reports and handles absence. | Can staff find the route without the message? |
| Authority | Who may approve the proposed change. | Is identity kept separate from permission? |
| Evidence | Minimal process notes with controlled access. | Are unknowns and missing handoffs recorded? |
| Follow-up | Named owner and a realistic completion date. | Can the corrected process be rehearsed again? |
Scope an active simulation as a separate activity
A live simulation is different from discussing a fictional message. It can affect mail filtering, external providers, employees and stored personal data. Before anyone sends it, define written authorization, the permitted recipients, infrastructure, timing, exclusion rules, stop contact and evidence handling. Consider staff communication and applicable workplace requirements. A supplier's advertised feature list does not provide this organizational authorization.
Keep real credentials, operational secrets and sensitive impersonation media out of the exercise. Do not impersonate a colleague through a voice clone merely to make the test harder. Agree how a real incident discovered during the activity will be distinguished and escalated. An exercise should not weaken production filtering broadly or persuade staff that normal reporting channels cannot be trusted.
Interpret results in the context of the scenario
NIST TN 2276 explains that an email's detection difficulty depends on cues and how its premise aligns with the recipient's context. The guide cautions against interpreting click results without that difficulty context. This means a different scenario can produce a different result without establishing that the organization became safer or less safe. Do not present one click rate as a complete business-risk measure.
Use a small set of process observations: whether reports reached an owner, whether the owner responded and whether the sensitive action remained controlled. In a small group, one person's action can noticeably change a percentage, and individuals may be easy to identify. Keep interpretation proportionate. If you intend commercial use of the formal Phish Scale, review NIST's licensing terms rather than assume that referencing the research grants permission.
Debrief the handoff and repair the process
A debrief should explain the requested action, the expected verification route and what happens after a report. Give people a way to describe uncertainty without public embarrassment. If the reporting mailbox was unattended or the deputy could not approve the change, assign that operational gap to an owner. Repeating the same scenario without repairing the missing handoff adds little practical value.
Keep only the notes needed for improvement, with appropriate access and retention agreed in advance. A private report should not become an open ranking of employees. Record the action, responsible person and how the correction will be checked. The next rehearsal can test the corrected route using a different fictional situation while preserving the same learning objective.
Connect awareness to the technical controls it depends on
Staff need understandable processes, but technical ownership still matters. Review who controls shared inboxes, who may grant application access and how account recovery reaches the business owner. Domain authentication and supported account protection can reinforce the workflow; neither removes the need for transaction approval. Keep the exercise's action list tied to controls the organization can actually maintain.
CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli technical knowledge. Our published services cover scoped website, email and account-control work. This guide offers a planning framework, not a claim that we operate a managed phishing-simulation platform or have delivered specific training programs. Discuss the actual technical scope and responsibilities rather than assume an ongoing awareness service or guaranteed outcome.
