Phishing Simulation Services

A phishing simulation is a controlled awareness exercise in which employees receive harmless emails that mimic real attacks, measuring who clicks a link, enters information or reports the message. Nokta Guard designs these simulations within ethical principles and data protection requirements and reports results with a focus on improving the organization, not singling out individuals.

Request a Quote

01 / 05

Why run phishing simulations?

Knowledge gained in training does not always translate into behavior when a real email arrives. A simulation measures how employees react within their daily workflow.

Results show which scenario types and which departments are most susceptible, so training can focus where it is needed. Repeating campaigns over time shows whether click rates fall and reporting rates rise.

02 / 05

What do we measure?

Email open and link click rates
Credential submission on a fake login page (passwords are not stored)
Attachment opening behavior, using harmless test files
Rate and speed of reporting the suspicious email to the security team

03 / 05

Ethics and data protection

Simulations exist to support learning, not to punish employees. We therefore agree on scope and rules beforehand with your management, HR and, where needed, your legal team.

Employee email addresses and click behavior are personal data; under Turkish data protection law (KVKK, Law No. 6698), informing employees about such exercises is your organization's responsibility.
Data is processed only for the simulation and only as much as needed; submitted passwords are not stored, and campaign data is deleted at the end of the period set in the contract.
We avoid themes that cause unnecessary distress, such as health, pay cuts, layoffs or personal tragedy.
Reports are aggregated by department and scenario by default; individual-level data is shared only for purposes agreed with you in advance.
Employees who click see a short, educational landing page rather than a punitive message.

04 / 05

How does the process work?

Planning: target groups, scenarios, schedule and communication plan are approved.
Technical preparation: settings needed for simulation emails to be delivered are configured with your team.
Delivery: the campaign is sent in stages and monitored.
Reporting: results are analyzed, compared with previous campaigns and turned into training recommendations.

05 / 05

What you receive

A campaign report by scenario, department and behavior
Period-over-period comparison and trend metrics
Targeted training recommendations based on the results

FAQ

Frequently Asked Questions

Are phishing simulations legal?

Simulations aimed at an organization's own employees, approved by management and with staff informed in advance, are a common security practice. Data protection principles such as transparency and proportionality must be followed, and we recommend reviewing the details with your legal team.

Should employees be told the simulation date in advance?

Employees are generally informed that phishing simulations will take place, but not the dates or content of campaigns. This keeps the process transparent while still allowing realistic measurement.

Are the names of employees who click reported?

Default reports contain aggregated results by department and scenario. Individual-level data is shared only for pre-agreed purposes such as targeted training, and only with a limited group.

How often should simulations be run?

Several campaigns a year are recommended to track behavior change; many organizations run them quarterly or every six months. Varying the scenarios each time is important.

Explore

Training & Awareness