The ethical pattern used by mature programmes is simple to say and easy to get wrong: tell everyone the programme exists, teach them the skill, and keep only the timing quiet. This page gives you the briefing, in the order it should happen.
Surprise is a tool with exactly one legitimate use in this programme - the day of the test. Surprise about the programme's existence, its rules or its consequences is not realism; it is an ambush, and ambushed staff learn resentment instead of security. Brief first, and the simulation becomes what it was approved to be: practice.
One short all-staff message or meeting segment covers it: the company runs simulated phishing as training; tests will arrive sometime this quarter without further warning; the purpose is practice; clicking brings a lesson, never trouble; reporting is the skill being built. That framing is not a leak that ruins the test - it is what makes the test legitimate, and a quarter is a wide enough window that nobody can simply stay alert for a week and relax.
A simulation that tests a skill nobody was taught measures nothing but luck. Before round one, show every employee the exact reporting route in your mail system - the Report Phish style button in their client, or the shared security mailbox if that is your process - and let them try it on a sample message. The campaign then practises a known skill under mild pressure, which is what training means.
Team leads will be asked questions you cannot predict, so equip them: this is training agreed by management and HR; nobody is disciplined for a click; if your team member is upset, send them to the programme owner, not to a group chat. A manager who improvises a threat - however jokingly - can undo the programme's trust in one sentence, so the lines are worth writing down and circulating with the approval.
New joiners hear the briefing at induction and are only included from the following round. Staff returning from long leave get the same catch-up. And leadership is inside the audience, not above it: senior inboxes are the most valuable phishing targets in the building, managers click in real incidents every week, and a programme that exempts the top quietly tells everyone it is theatre.
Watch the video build the campaign that goes out after the briefing is done.
▶️ Watch Full VideoThe announced window is a whole quarter, not a week - nobody sustains test-mode alertness for three months. What the announcement really changes is the meaning of a click: practice they agreed to, not a trap they resent.
Yes - a short note when the window closes: the totals, the lesson the email taught, and thanks to the reporters. Closing the loop keeps the programme visible as training rather than as silent surveillance.
That is the one shortcut this programme refuses. An unannounced baseline measures people who were never taught the skill or told the rules, and the resentment it creates costs more than the data is worth.