In short: IRONSCALES Phishing Simulation Testing sends simulated phishing based on real-world threat data and generative AI, from a template library IRONSCALES refreshes to match current trends. It can personalise spear phishing, shows instant feedback on landing pages, assigns training to people who are caught and reports who received, opened, clicked or reported each test.
What it is
Phishing Simulation Testing is the simulation half of IRONSCALES' human risk management offering, sitting alongside its security awareness training and its email security for Microsoft 365 and Google Workspace.
The idea is that an email security vendor sees a constant flow of real phishing. IRONSCALES says its simulations use real-world threat data and generative AI to mirror the attacks your users might actually face, rather than relying only on generic, ageing templates. For the general principles, see our guide to phishing simulation.
How simulations are built
- Template library: IRONSCALES lists more than 100 templates and says they are refreshed to match current phishing trends
- Personalised spear phishing: IRONSCALES says generative AI can create highly personalised spear phishing emails using insight from employees' inboxes, with the sender, subject, body and requested action all editable
- Phishing Simulation Agent: part of IRONSCALES' human risk management offering, it gathers open-source intelligence from social media and the public web to build tougher tests that reflect the tactics aimed at your organisation
- Landing pages: use ready-made pages or build your own, giving immediate feedback and education to anyone who takes the bait
Realistic lures teach more, but they must be handled with care. We avoid scenarios that could cause genuine distress, such as fake bonus or redundancy news, in line with the NCSC's view that simulations should support staff rather than trick them; see NCSC guidance on staff security awareness training.
Targeting, scheduling and training on failure
Campaigns can go to everyone, specific departments, executives or frequently targeted individuals. IRONSCALES describes adaptive targeting that looks at risk factors such as how often someone is attacked, previous failures and click behaviour.
| Feature | What it does |
|---|---|
| Adaptive content | Automatically sends tailored simulations to people who have never been tested or who failed their last test |
| Scheduling | Set the cadence, audience and difficulty in advance so campaigns run without constant attention |
| Instant alerts | People who fall for a simulation are told straight away, while the lesson is fresh |
| Training on failure | Optional short modules matched to the tactic the person missed |
Training on failure works best when it is short and specific. A two-minute lesson on the exact trick that caught someone is more useful than a long general course.
What the reports show
IRONSCALES campaign statistics track who received, opened, clicked or reported each simulation. Dashboards break down delivery, engagement and completion by individual, department or smart group, and executive summaries can be downloaded for audits.
The figures we focus on with clients are:
- Report rate: the share of people who reported the simulation, the best sign of a healthy culture
- Click and submission rates by group, to find teams that need extra help
- Repeat clickers, who should get coaching, not blame
- Trend over time, which matters far more than any single campaign
Every simulation result and reported email also feeds the user's live risk score. For a fuller approach to metrics, see how to measure security awareness training effectiveness.
Reporting suspicious email
Simulation only works if people know what to do when something looks wrong. IRONSCALES gives employees a report phishing button, alongside warning banners that flag suspicious messages in the inbox. When a simulation is reported, that counts as a success; when a real phishing email is reported, it feeds IRONSCALES' crowdsourced threat intelligence and helps the platform deal with similar messages.
Make reporting the hero of every campaign. Thank people who report, share examples and keep the process to one click. Our page on how to report a phishing email also covers the UK's national reporting routes.
How we run IRONSCALES simulations
We can run IRONSCALES phishing simulation as part of our managed security awareness training:
- Agree rules of engagement with you: themes to avoid, who is excluded and how results will be used
- Run a baseline campaign across the organisation
- Set up adaptive campaigns for people never tested and those who failed last time
- Add personalised spear phishing for high-risk roles such as finance and executives, with your agreement
- Link failures to short training modules and track completion
- Report trends, report rates and repeat clickers each quarter
Business email compromise is a particular risk for finance teams; see business email compromise training. Contact us to plan a baseline campaign.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does IRONSCALES use AI for phishing simulations?
Yes. IRONSCALES says its simulations draw on real-world threat data and generative AI, and that generative AI can create personalised spear phishing emails. Its Phishing Simulation Agent also gathers open-source intelligence from social media and the public web to build tougher tests.
How many phishing templates does IRONSCALES have?
IRONSCALES lists more than 100 simulation templates and says the library is refreshed to match current phishing trends. You can also customise the sender, subject, body and requested action.
What happens when someone fails an IRONSCALES simulation?
They receive an instant alert and can be sent a short training module matched to the tactic they missed. Adaptive content can also send them a follow-up simulation.
Is it ethical to send fake phishing emails to staff?
Yes, when it is done openly and supportively: staff know simulations happen, results are used for coaching rather than discipline, and distressing themes are avoided. Our security culture page explains the approach.