Phishing Simulation & Security Awareness Training

Phishing is consistently the most common starting point for real-world security incidents, because it targets people rather than infrastructure. The most reliable way to find out how exposed an organization actually is — and to close that gap — is to run controlled, authorized simulated phishing campaigns and use the results to drive targeted training.

This document lays out a complete, ready-to-run program for Internee.pk: how to get the right approvals in place, how to set up and run the simulation using GoPhish (a widely-used, open-source phishing simulation framework), sample email templates, the metrics to track, a report template for summarizing results to leadership, and a remediation plan to turn findings into measurable improvement.

• Establish a measurable baseline of how susceptible Internee.pk employees currently are to common phishing tactics.
• Run realistic, low-risk simulated phishing campaigns using GoPhish, in clearly scoped waves.
• Track every meaningful interaction — delivery, opens, clicks, data submission, and self-reporting to IT/Security.
• Translate raw campaign data into a clear Security Awareness Report for leadership, broken down by department and risk theme.
• Close the loop with targeted training and a re-test cycle so the program produces a trend, not just a one-time snapshot.

3.1 — Required Sign-Offs

• ✓
  Senior Leadership / Executive Sponsor — aware of the program, timing, and expected disruption.
• ✓
  IT / Security Lead — owns the GoPhish instance, sending domain, and incident response coordination during the test window.
• ✓
  HR — confirms the program is framed as training and coaching, not discipline, and approves how results tied to individuals will (and will not) be used.
• ✓
  Legal / Compliance — confirms the activity is consistent with Internee.pk's IT-use policy, employment agreements, and applicable law. In Pakistan this includes awareness of the Prevention of Electronic Crimes Act (PECA) 2016.

3.2 — Rules of Engagement (RoE)

Define all of the following in writing before any email is sent:

• Exact scope: which departments/employees are in-bounds, and any individuals or systems that are explicitly out of bounds.
• Test window: start/end dates, and blackout periods (e.g., avoid quarter-end, major launches, or other high-stress periods).
• Data handling: what is captured (clicks, submitted form data), how long it's retained, who can see individual-level results, and confirmation that any "credentials" entered into a landing page are never logged in plaintext or reused.
• Emergency stop: a named contact and process to immediately pause the campaign if something goes wrong (e.g., the email escalates into a real panic, or IT's helpdesk gets overwhelmed).
• No real harm clause: simulated emails will never contain real malware, destructive macros, or links to anything outside the controlled GoPhish/landing-page environment.

3.3 — Employee List

• Only use Internee.pk's existing internal directory — the one already used for legitimate internal communication — never a scraped, purchased, or third-party list.
• Confirm with HR/IT that using the directory for an internal awareness exercise is covered by existing employee policy acknowledgements.
• Segment the list by department/role at import time (Finance, Engineering, Support, Leadership) — this is what makes the departmental breakdown in the report possible.

The program runs as eight phases. Phases 1–3 are entirely planning and setup; nothing is sent to a real inbox until Phase 5's small pilot has been validated.

GoPhish is a self-hosted, open-source phishing simulation framework (MIT-licensed Community Edition) built specifically for this use case. Security teams and penetration testers use it to design email templates and landing pages, send tracked campaigns to a target list, and review results in a web dashboard.

5.1 — Setup Checklist

• ✓
  Provision a dedicated, isolated server or VM for GoPhish — do not run it on a production box.
• ✓
  Download the official release binary and verify the SHA256 checksum before running it.
• ✓
  Run the binary — it starts an HTTPS admin dashboard (default port 3333) and a separate listener serving landing pages to recipients.
• ✓
  Log in with the one-time admin credentials printed to the console on first run, then immediately change the password.
• ✓
  Replace the default self-signed certificate with one from a real certificate authority if the dashboard will be reachable outside localhost.
• ✓
  Create a Sending Profile: a dedicated test mailbox (not a real executive account), with SPF/DKIM configured for that sending domain.
• ✓
  Import the segmented target list from Phase 2 as a User Group (CSV: first name, last name, email, position/department).
• ✓
  Build email templates and the landing page (see §6 and §7).
• ✓
  Run the Phase 5 pilot to a small internal group before touching the full employee list.
• ✓
  Schedule the full campaign in staggered waves, monitor the results dashboard in real time.

5.2 — Landing Page Guidance

Resist the urge to create a pixel-perfect clone of Internee.pk's real production login page on a look-alike domain — that crosses from "simulation" into something closer to a real credential-harvesting setup, even internally.

• Use a clearly internal, recognizable-as-a-test URL/subdomain rather than a deceptive look-alike domain.
• Configure GoPhish to capture only whether a submission happened (and which fields were touched), never real passwords — instruct the landing page to discard or mask any "password" field value.
• Immediately redirect every submission to a short, friendly "You just experienced a simulated phishing attempt" page that explains the red flags the recipient missed and how to report similar emails in the future.

These three templates cover the most common real-world phishing pretexts. Each uses generic, low-risk framing — replace placeholders, but keep them broadly plausible rather than impersonating a specific real person without consent.

Template 1 — IT Password Expiration

Template 2 — HR Benefits Enrollment Deadline

Template 3 — Package Delivery Notification

GoPhish's dashboard reports raw events in real time. These are the metrics that matter for the awareness report:

9.1 — Report Outline

• Cover page — campaign name, date range, prepared by, confidentiality marking.
• Executive summary — top-line numbers and the one or two biggest takeaways.
• Methodology recap — template(s) used, target group, sample size, dates.
• Results table — sent / opened / clicked / submitted / reported, with rates.
• Departmental breakdown — which teams are highest- and lowest-risk.
• Trend vs. previous wave — once a second campaign has run.
• Key findings — the specific lure elements that worked, in plain language.
• Recommendations — training topics, policy or technical control changes (banner warnings on external mail, MFA, stricter attachment filtering).
• Appendix — the template(s) used, marked Internal Use Only.

9.2 — Sample Results Table (illustrative only)

• Immediate micro-training: Anyone who clicks or submits data lands on a 2-minute explainer right after the simulated email — while the experience is fresh, not a generic module weeks later.
• Aggregate, anonymized debrief: A short all-hands or department session walking through what the data showed, without naming individuals.
• Targeted refresher modules for the highest-risk departments identified in §9.2, focused on the specific lure types that worked against them.
• Positive reinforcement for reporting: Recognize teams/individuals who reported suspicious emails — that is the behavior you most want to reward.
• Re-test in 60–90 days using a comparable (not identical) template, to measure real improvement rather than memorized recognition of one specific email.

• Never proceed without written authorization and a signed RoE (§3) — this is non-negotiable, not a formality.
• Never include a real malicious payload, destructive macro, or link to anything outside the controlled GoPhish environment.
• Discard or mask any "password" values entered on the landing page; never store real credentials, and never reuse anything captured.
• Individual-level results should only go to HR/the employee's manager if needed for coaching — keep all organization-wide reporting aggregated by department.
• Treat this as training, not discipline. The goal is a lower click rate next time, not a list of people to penalize.
• Loop in Legal/Compliance on anything touching Pakistan's PECA 2016 and data-protection rules before the first email goes out, and on any cross-border data handling if Internee.pk's staff or infrastructure span multiple countries.

Suitable for distribution as a one-page handout or intranet post once the program has run its first cycle.

How to spot a phishing email

• The sender's domain looks almost right but isn't — read it character by character, not just at a glance.
• The message creates urgency or fear: a deadline, a threat of suspension, a missed delivery.
• The greeting is generic ("Dear Customer," "Hi User") instead of using real, specific details only your real contacts would know.
• It asks you to click a link or open an attachment to "verify," "confirm," or "resolve" something you weren't expecting.
• Hovering over a link (without clicking) shows a destination that doesn't match the text or the sender.
• It asks for a password, payment, or sensitive data directly over email.

What to do instead