The template is where a training programme quietly shows its character. Too fake and nobody learns anything; too vicious and you have frightened your own staff for a metric. This page draws the line that experienced programme owners draw - believable, fair, and never cruel.
Real phishing works because it looks like Tuesday. Your simulation should imitate that ordinariness - the shared file, the mailbox notice, the delivery update - while leaving out the emotional weapons. The design test is simple: could a careful reader spot this, and would a person who fell for it feel taught rather than tricked?
Look at what your gateway and your users genuinely see: document-sharing notices, password and mailbox alerts, courier messages, meeting and invoice mail. Build the template in that family, in the plain style of an internal service message. Base it on the patterns of real attempts - urgency, a link that does not match its text, a slightly wrong sender domain - not on copying a real outside brand's artwork, which has no place outside an authorised internal exercise and is unnecessary for the lesson.
Never simulate: a bonus, salary or appraisal outcome; a termination or disciplinary threat; a medical or family emergency; a message pretending to be from a named senior leader ordering secrecy or payments. These cause real anxiety, real phone calls to HR, and occasionally real harm - and the staff who fall for them learn only that IT is willing to frighten them. Every security-awareness community treats these as out of bounds. Your approval document should list them as excluded, by name.
The sender display name and domain do half the teaching. Use your owned training domain with a plausible service name, keep the subject ordinary - real phish rarely shouts - and check the message on a phone as well as a desktop, because that is where most of your staff will meet it. Then send it to yourself and IT first: if your own team cannot spot the intended tell, the template is not ready.
Watch the video build a campaign template and landing page inside the platform, step by step.
▶️ Watch Full VideoNo. Build generic, internal-style scenarios - a shared document, a mailbox notice - based on the patterns of real attacks. Impersonating a real outside brand is unnecessary for the lesson and inappropriate outside the narrowest authorised internal context.
Because the goal is a habit, not a ranking. Staff who are beaten by an impossible test learn helplessness; staff who spot a fair test learn the check that worked - and use it on the real thing.
One per audience group is enough. A single well-designed scenario with one clear lesson beats five mixed messages, and it keeps the results readable - you learn exactly which habit needs work.