Phishing simulation for businesses
A phishing simulation shows how many of your employees would click on a fake email: safely, under control and with formal permission. The simulation is part of Lumyo Awareness. First measure where you stand, then train specifically where it is needed.
What is a phishing simulation?
In a phishing simulation we send realistic fake emails to your employees, on behalf of your organisation. Exactly as a real attacker would. Every click, every entered detail and every report is recorded, but nothing goes wrong: the fake page shows a learning moment instead of causing damage.
The result: you know which employees, departments or locations need extra attention. The aim is not to catch people out, but to reveal weak spots before a real attacker does.
A simulation is therefore not just a measurement, it is also a learning moment. Most employees know that phishing exists. Only when they receive a convincing fake email themselves and see how easy it is to fall for it does the message really land.
How does a phishing simulation work?
- Intake meeting: we discuss your organisation, its departments and which attack scenarios are relevant. The legal preparation is part of this.
- Building scenarios: together, or based on current threats, we create convincing phishing emails, in your own house style if you wish.
- Campaign (2 to 4 weeks): the emails are sent in phases. Employees do not know in advance that a test is running.
- Live insight: the dashboard shows who clicks, who reports and who enters login details.
- Report and review: afterwards you receive a report with click rates per department and a management summary.
- Targeted follow-up: employees who clicked are offered a learning moment, if you wish through the Lumyo phishing training.
Which scenarios do we use?
In the intake meeting we discuss which scenarios are most relevant to your sector and organisation. Not everything has to be complicated to be effective. The variants increase in preparation and realism:
Generic scenario
A fake parcel notification or an imitation Microsoft alert. Widely applicable and the quickest to set up.
Company-specific scenario
Using the name of a supplier or department. More preparation, but a stronger learning moment.
Campaign per department
Different scenarios per department or location. More complex, and it gives more insight.
Multi-stage attack
Email, fake page and login attempt in sequence. The most realistic, and the most preparation.
What the simulation delivers
At the end of a campaign you know where your organisation stands:
Click rate per department
Who clicked, who entered details, and where the weak spots are concentrated
Report rate
How many employees reported the suspicious email on their own initiative, the strongest sign of awareness
Comparison over time
A repeat measurement after six months shows in black and white what the training achieved
The report includes
- Click rate per scenario and in total
- Breakdown by department and location
- Management summary for the board or management team
- Concrete recommendations for follow-up and training
- Documentation you can use for compliance
Additional work, such as a presentation to the board or works council, or a specific audit report for ISO 27001 or NIS2, is priced separately.
Why repeating pays off: a first measurement shows where you stand. Only a second measurement shows whether anything has changed. That is why a programme always consists of a baseline and a follow-up measurement, not a single test.
Why a phishing simulation?
- Insight into the real phishing vulnerability of your organisation
- A view of employees and departments with a higher risk
- Evidence of awareness for auditors and insurers (ISO 27001, NEN 7510, NIS2)
- A measurement to demonstrate improvement: repeating after six months shows what has changed
- Employees who recognise and report phishing sooner from then on
Why it matters: phishing is the most common initial access route in data breaches, accounting for 17% of all incidents (IBM, Cost of a Data Breach 2026). The human element plays a role in 62% of data breaches (Verizon DBIR 2026). A simulation makes that risk visible and measurable.
Contract and legal framework
A phishing simulation requires formal permission from the organisation and, depending on the collective labour agreement or company regulations, the agreement of the works council. We guide you through this process. Without prior written permission, given by the management or another authorised person, we do not run a simulation.
In the order confirmation we record at least:
- the target group and size of the simulation
- the period in which the simulation takes place
- the scenarios and domains to be used
- which systems and data fall within scope
- who within the organisation can be contacted during the simulation
You inform your own IT department or IT supplier in advance, so the simulation is not mistaken for a real attack. We never work outside the agreed scope; any extension is recorded separately in writing.
Personal data is processed in line with the GDPR. You are the controller, we are the processor, and we sign a data processing agreement for this. Reporting is aggregated wherever possible; traceable results go only to the contact person you appoint. What we see about weak spots in your organisation during a simulation, we share with no one.
Lumyo Awareness is provided by CoBoo. Everything is set out in articles 5, 9 and 10 of our terms and conditions.
What does a phishing simulation cost?
You do not need to fill in a form to get an indicative price. These are the rates:
| What | Price | What you get |
|---|---|---|
| One-off phishing simulation | from € 1,250 | Intake meeting, tailored scenarios, running the campaign and a final report with management summary |
| Annual programme | € 1.50 per employee per month (€ 18 per year), minimum € 250 per year | 10 phishing campaigns spread over the year, with baseline, follow-up measurement and trend reporting |
| Simulation and training together | € 4.50 per employee per month (€ 54 per year) | The annual programme plus the Lumyo awareness training, available from the launch of the training platform |
| Onboarding (one-off) | € 350 | One-off setup and alignment at the start, also if you take both |
An example for the annual programme: with 40 employees that is 40 × € 18 = € 720 per year, plus € 350 onboarding in the first year. Small teams pay a minimum of € 250 per year; that applies with 13 employees or fewer.
The one-off simulation is a starting price. A larger organisation, several scenarios side by side or a campaign segmented by department costs more. What fits your situation is set out in the quote, which is without obligation. More on how prices are built up: security awareness training costs.
Simulation and training together
A simulation without follow-up is a missed opportunity. Employees who clicked learn the most when they are guided to a learning module straight afterwards. The Lumyo phishing training is the logical next step: short modules of 10 to 15 minutes, on any device.
That way you not only know who needs extra attention, you also make sure they actually get it. You can start phishing simulations now; the training is available from the launch of the training platform.
Frequently asked questions about phishing simulations
Is a phishing simulation legal?
Yes, provided it is carried out with formal permission from the organisation. Every simulation is set out in a written assignment. Depending on the collective labour agreement or company regulations, the works council may also need to agree. We never run a simulation without explicit written permission from the client.
Do employees know a phishing simulation is running?
No, that is exactly the point. Employees receive the fake emails at a random moment during the campaign period of 2 to 4 weeks. That way the simulation gives a realistic picture of behaviour under real conditions. Afterwards there is always a learning moment.
How long does a phishing simulation campaign take?
A standard phishing simulation takes 2 to 4 weeks. During that period the emails are sent in phases, so you get a representative picture of awareness within your organisation. Afterwards you receive a report with findings and recommendations.
How often should you run a phishing simulation?
At least twice a year. The first simulation gives the baseline; repeating it after six months shows what has changed. Organisations with NIS2 or ISO 27001 obligations often choose quarterly campaigns. That is why the annual programme includes 10 campaigns per year.
What does a phishing simulation cost?
A one-off phishing simulation costs from 1,250 euros. The annual programme with 10 campaigns costs 1.50 euros per employee per month (18 euros per year), with a minimum of 250 euros per year. For both options a one-off onboarding fee of 350 euros comes on top. The one-off simulation is a starting price: a larger organisation, several scenarios side by side or a campaign segmented by department costs more.
Which sectors is a phishing simulation suitable for?
All sectors: healthcare, financial services, manufacturing, construction, business services and more. Phishing hits businesses regardless of sector, because the weak spot is always people.
Schedule a free introduction
Whether you have 5 or 500 employees, there is a solution for every business size.
This opens your email client. You send the email yourself.