Every simulation funnels to one page. Built well, it converts an embarrassing click into the most memorable security lesson of the year. Built badly - with a working login form that stores what staff type - it becomes the most dangerous database in your company. This page covers both the design and the hard rule.
The click is not the lesson; it is the doorway to the lesson. What loads in the next two seconds decides whether the employee leaves sharper or leaves angry. Keep it calm, make it specific, and above all keep it incapable of collecting the one thing it must never hold.
The page should say, in plain words and within the first screen: this was a simulated phishing email sent by your own organisation as training; you are not in trouble; here is what gave it away. Then show the actual evidence from that campaign - the sender domain next to the real one, the link text beside its true destination, the urgency line that pushed for speed. Specific beats generic: people remember the exact tell they missed, and they look for it next time, including on real mail.
Some platforms ship templates with a login form that captures whatever is typed. Do not use them. The reasons are not soft: a stored set of real staff passwords is a high-value breach target you created yourself; handling it drags the programme into data-protection trouble; and it teaches nothing - the click already proved the point. Configure the page to record the visit only. If a form appears for realism, it must not transmit or store entries, and the honest design is simpler still: no working form at all, straight to the lesson.
Record the minimum the programme needs: that the page was reached, when, and which campaign it belonged to - plus, from the mail platform, who reported the message, because reporters are the success story. That is the whole list. No keystrokes, no credentials, no personal device snooping. Data you never collect can never leak, never embarrass anyone in a meeting, and never need defending to HR.
Watch the video set up the landing page inside the platform and check what a campaign records.
▶️ Watch Full VideoNo. Leave it disabled. The click already demonstrates the risk; harvesting real passwords adds a serious data-protection and breach problem while teaching nothing extra. Record the visit, show the lesson.
No. Keep the page identical and generic for everyone. Individual follow-up happens privately, from the programme owner - never through a page that singles a person out in front of their screen.
On a correctly built teaching page there is no working form, so nothing can be typed, transmitted or stored. That impossibility is deliberate - it is what makes the exercise safe by design.