This is a problem that has been bothering me somewhat.

I am able to run a phishing simulation campaign against users across the organisation. If the user clicks on a bad link they are directed and told that they have made a mistake and that they should not have clicked. They are then offered some guidance on what the correct actions should have been through a webpage.

This all sounds great, but how can assurance be given to users it isn't a sophisticated phishing attack?

I have thought about using existing phishing material internally used, and have the link point to the intranet - is there a better way?

1 Answer 1


You can try the following options:

  • Have someone trusted in the organization warn them that there will be a test that will target the organization.
    This way if they see your message they know that it is a test and all is okay and it is not a sophisticated phishing scam.

  • Add your contact information regarding any questions and that way when they call you can explain to them the situation (You should place this in a visible place on the "You made a mistake" page so they can clearly see it).

  • Maybe I am overdoing it now, but (a) just because they know there will be a test does not mean they know that this is the test, and (b) the contact info could be fake.
    – Anders
    Commented Jun 30, 2016 at 11:33
  • . (a) - You can post on the page that this is the test that they have been told there will be. (b) Well this would depend on the size of the organization. I was assuming that people know you... Commented Jun 30, 2016 at 12:26
  • I agree with the forewarn - I will be sending out reminders before to test the effectiveness of any awareness campaign. Also, including the contact details was something I haven't thought of, which a simple thing to overlook! - Whether they know me or not, is tricky. I could always use a more commonly known contact such as the Service Desk. I think it may be important to not include any further links in the webpage training, and have it as a single page. Commented Jun 30, 2016 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .