Before you begin

  • An active Encrisoft account

    You must be able to sign in to Encrisoft and access your organisation's workspace.

  • Employees added to your organisation

    Ensure the employees or groups you want to include in the simulation are available in Encrisoft.

  • Appropriate permissions and access

    Your account must have permission to create and launch phishing simulations.

What Is a Phishing Simulation?

A phishing simulation is a controlled exercise designed to help organisations understand how employees respond to emails that imitate common phishing attempts.

These emails may resemble messages from trusted organisations, colleagues, or familiar services. They might ask recipients to click a link, open an attachment, or take action urgently.

Unlike real phishing attacks, simulations are conducted for security awareness purposes. They help organisations identify knowledge gaps, understand employee behaviour, and determine where additional training may be useful.

With Encrisoft, you can use phishing simulations as part of your organisation's wider security awareness programme, helping your team practise recognising suspicious messages in a controlled environment.

Before You Get Started

Before creating your first phishing simulation, make sure your Encrisoft workspace is ready. You'll need an active account, access to your organisation's workspace, and the appropriate permissions to create simulations. You should also ensure that your intended participants have been added and that any required setup, domain verification, and subscription steps have been completed.

If you haven't completed these steps yet, the following guides will help you get ready:

Once your organisation is ready, you're all set to explore phishing simulations.

Step 1: Open the Simulations Section

Encrisoft dashboard sidebar with the Simulations navigation option highlighted

Start by signing in to your Encrisoft account.

From your dashboard, locate the navigation menu on the left-hand side and select Simulations.

This section is where you access the platform's phishing simulation features and manage simulation activities.

If you're new to the platform, take a moment to familiarise yourself with the available options before proceeding.

Step 2: Start Creating a Simulation


Encrisoft Simulations page showing the option to create a new phishing simulation.

Once you're in the Simulations section, look for the option to create or start a new simulation.

Select it to begin the setup process.

Depending on the options available in your Encrisoft workspace, you'll be guided through the settings required to configure your simulation.

Before proceeding, make sure you understand the purpose of the exercise. For your first simulation, it's best to focus on helping employees recognise common phishing indicators rather than trying to make the exercise unnecessarily complicated.

Step 3: Choose a Template and Name Your Simulation

Encrisoft phishing simulation configuration screen showing the available setup fields and options.

The Template stage determines what your employees will receive. A template provides the phishing scenario used in your simulation.

First, enter a descriptive name in the Simulation name field. Choose a name that makes the campaign easy to identify, such as Q3 IT Department Phishing Test.

Next, select Use a Template to choose a phishing scenario from the available templates.

In the example shown, the selected template is Mailbox session expired, which uses a Credential Harvesting approach. This scenario resembles an account notification and can help employees practise recognising suspicious messages that request account information.

If you want to use a different scenario, click Change Template and select another available template.

Once you have chosen your template and entered a name, click Continue to proceed to the Audience stage.

Step 4: Select Your Audience

Encrisoft Audience stage showing the Specific people, A team and A department options, employee search field, recipient selection and audience summary.

The Audience stage determines who receives your phishing simulation. You can target specific employees, an entire team or a department, depending on the purpose of your exercise.

Under Who should receive this simulation?, choose one of the available options:

  • Specific people: Select individual employees to include in the simulation.
  • A team: Choose a team to receive the simulation.
  • A department: Choose a department to receive the simulation.

If you select Specific people, use the Search people field to find employees and select the relevant names from the list. Review your selections to ensure that the intended recipients are included.

Before proceeding, check the audience summary displayed on the screen. It shows the total number of recipients, internal recipients and external participants included in your selection.

Once you have confirmed your audience, click Continue to proceed to the Configuration stage.

Step 5: Configure Your Simulation

The Configuration stage determines how and when your phishing simulation runs. Here, you can review the email destination settings, choose the simulation domain, and decide whether to launch the simulation immediately or schedule it for later.

Start by reviewing the Preview the email this simulation will send section to understand the email associated with your simulation.

Next, check the Link target type setting. This determines where recipients are directed when they click the link in the simulated email. The screenshot shows platform landing as the selected option. Encrisoft also provides a safety notice explaining that a simulation cannot launch until a destination has been selected for recipients who click the link. The available destinations are platform-managed, so you do not need to enter an external destination yourself.

Under Simulation domain, review the domain selected for your campaign. In the example shown, the selected option is Primary Encrisoft simulation domain — simulation.encrisoft.com. The domain is displayed below the selection field.

Finally, choose when your simulation should run under When to launch. You have two options:

  • Launch now: Begin sending the simulation after launch.
  • Schedule: Choose a date and time for the simulation to run.

Once you have reviewed the settings and selected your preferred launch option, click Continue to proceed to the Review stage, where you can check the simulation details before launching or scheduling it.

Remember: Configuration determines how and when your simulation runs. Review each available setting carefully to ensure it aligns with your organisation's security awareness objectives.

Encrisoft Configuration stage showing the link target type, simulation domain, Launch now and Schedule options, and Continue button.

Step 6: Review Your Simulation Before Launching

The Review stage gives you a final overview of your simulation before it is launched. Review the displayed details, including the selected template, recipients, simulation domain, approval requirements and launch schedule, to ensure everything is correct.

You can also expand Review the email recipients will see to preview the email and check the What Encrisoft tracks section to understand which recipient actions are monitored and how the results are interpreted.

Once you have confirmed the details, click Launch simulation to start your campaign.

Encrisoft simulation Review screen showing the campaign details, selected template, audience, simulation domain, schedule, email preview option, tracking metrics, result interpretation guidance, and the Launch simulation button.


Step 7: Verify Your Identity and Launch Your Simulation

When you click Launch simulation on the Review screen, Encrisoft may prompt you to verify your identity before proceeding. This is an additional security measure designed to confirm that you are authorised to launch the simulation.

A Verify it's you window will appear, asking you to confirm your identity. You can choose from the verification methods displayed:

  • Email verification: Receive a verification code by email and enter it in the provided fields.
  • Password: Confirm your identity using your account password.
  • Authenticator App: Use your authenticator app to complete verification.
Encrisoft identity verification window showing the Email verification, Password and Authenticator App options, verification code fields, Resend code link and Verify and continue button.

If you choose Email verification, check your inbox for an email from Encrisoft titled Your Encrisoft verification code. Open the email and enter the six-digit code into the verification fields and click Verify and continue. If you don't receive the code, check your spam or junk folder or select Resend code to request another one

Gmail displaying an email from Encrisoft containing a six-digit verification code and its expiry information.

Once your identity has been verified, Encrisoft will process the launch. When successful, a confirmation window displaying Simulation launched will appear, indicating that Encrisoft has started processing the simulation for the selected recipients.

Encrisoft displaying a Simulation launched confirmation message, indicating that processing has started for one recipient, with options to View simulation or Back to simulations.

Click View simulation to open your campaign dashboard. Here, you can see the simulation's status, displayed as Completed at the top of the page, alongside key figures showing how many emails were sent, opened, clicked, reported or resulted in simulated credentials being submitted.

Encrisoft simulation dashboard showing a completed phishing campaign, with summary cards for emails sent, opened, clicked, reported and simulated credentials submitted. The Overview, Targets, Results and Timeline tabs provide access to campaign details, while the tracking and results interpretation sections explain how recipient activity is recorded and assessed.

You can also explore the Overview, Targets, Results and Timeline tabs to see more details about your campaign.

And just like that, your first phishing simulation is complete! 🎉 You've chosen your template, selected your audience, configured your simulation and launched your campaign.

But don't stop there! Take a look at your simulation results to understand how your organisation responded and identify opportunities to improve security awareness.

Remember, the goal isn't to catch people slipping; it's to help them spot the phish before it bites! 🐟