> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/how-to-documentation/make-simulations-challenging-but-fair.md).

# Make Simulations Challenging but Fair

{% hint style="info" %}
Simulations are most effective when they mirror real-world threats without blindsiding employees. Too easy, and your team learns very little. Too tricky, and you erode trust, spike anxiety, and teach people to fear your security program instead of embracing it.

Simulations in Herd should help employees feel **prepared**, not punished.
{% endhint %}

***

### Foundations for Fair and Effective Simulations

These principles apply across every simulation type in Herd.

#### 1. Start at the Right Difficulty Level

Match difficulty to your organization's current security maturity.

| Level            | Characteristics                                                     |
| ---------------- | ------------------------------------------------------------------- |
| **Beginner**     | Generic sender names, clear urgency cues, mismatched URLs           |
| **Intermediate** | Branded templates, plausible scenarios, subtle red flags            |
| **Advanced**     | Highly targeted content, internal impersonation, multi-step attacks |

{% hint style="info" %}
In Herd, you can gradually increase simulation sophistication as your users improve over time.
{% endhint %}

#### 2. Never Use Emotionally Manipulative Content

Simulations should test alertness — not exploit personal fears.

{% hint style="danger" %}
**Avoid scenarios like:**

* *"Your paycheck has been delayed"* — creates real financial anxiety
* *"HR has flagged your conduct"* — triggers fear of job loss
* *"A family member has tried to reach you"* — crosses personal boundaries
  {% endhint %}

#### 3. Always Follow Up with Education, Not Blame

When an employee falls for a simulation, the next step should be learning — not a public call-out.

{% hint style="info" %}
**In Herd:** Link a training module to your simulation so that when an employee fails, they are automatically enrolled in a follow-up course. Every miss becomes a structured learning opportunity.
{% endhint %}

#### 4. Maintain a Consistent, Rolling Cadence

Sporadic, one-off simulations feel like "gotcha" moments. Running simulations on a regular cadence — for example, monthly per employee — helps people see them as an ongoing part of your security program rather than rare surprises.

At the same time, keep individual messages unpredictable. Stagger send times and vary templates so employees might encounter a simulation while busy or distracted — just like a real attack.

{% hint style="success" %}
Communicate clearly that simulations are a standing, learning-focused control — not a punishment tool. This framing reduces stress while still teaching employees that suspicious messages can appear at any time.
{% endhint %}

***

### Phishing Simulations

Phishing remains the most common attack vector. Effective simulations train employees to pause and review emails before acting — even when they appear legitimate.

#### What Makes a Phishing Simulation Effective

{% stepper %}
{% step %}

#### Choose Realistic but Recognizable Scenarios

Use scenarios employees are likely to encounter: shared document notifications, IT password resets, benefits enrollment reminders. Red flags should be present but not obvious.

* Use sender names that look almost correct (e.g., `support@company-helpdesk.com` vs. `support@company.com`)
* Include a plausible call-to-action — review a document, sign in to verify, confirm details
* Avoid obvious typos or broken formatting at beginner levels — real attacks increasingly look polished
  {% endstep %}

{% step %}

#### Build in Detectable Red Flags

Each simulation should include at least one clear signal that something is off. The goal is to train employees to look for signals — not to trick them indefinitely.

* Mismatched reply-to and sender addresses
* URLs that don't match the claimed domain
* Unusual urgency or pressure to act within minutes
* Requests for credentials or sensitive information via email
  {% endstep %}

{% step %}

#### Vary Your Templates Over Time

Reusing the same template only trains people to spot *that* simulation. Rotate scenarios across IT alerts, HR communications, and vendor invoices to keep coverage broad and realistic.

Track results in your Herd dashboard or within the specific campaign. You can also ask Herd AI for statistics on individual campaigns.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
**In Herd:** Browse the simulation template library and rotate between categories each quarter. You can automate this by creating a phishing campaign that contains multiple templates.
{% endhint %}

#### What to Track

| Metric               | What It Tells You                                                     |
| -------------------- | --------------------------------------------------------------------- |
| **Click rate**       | Percentage of recipients who clicked the simulated link               |
| **Report rate**      | Percentage who flagged the message as suspicious                      |
| **Dwell time**       | Time between delivery and click — longer often indicates more caution |
| **Repeat offenders** | Employees who fail multiple simulations and may need targeted support |

***

### SMS Phishing (Smishing) Simulations

Smishing is growing quickly, and employees are often less guarded on their phones than on email — which makes smishing simulations a valuable but frequently underused control.

#### What Makes a Smishing Simulation Effective

* **Mirror common SMS scams** — package delivery failures, bank alerts, two-factor prompts, or IT helpdesk texts
* **Keep messages concise** — real smishing attacks are short and direct
* **Include a link** the employee is asked to tap or visit, and use a plausible sender name or short code
* **Account for the mobile context** — on mobile, employees can't hover over links to preview URLs; design simulations that teach mobile-specific detection skills like recognizing shortened links, unfamiliar numbers, and unexpected requests

{% hint style="warning" %}
**Fairness consideration:** Because smishing is newer to many employees than email phishing, start with clear red flags (unfamiliar sender numbers, misspelled brand names) before progressing to more subtle scenarios.
{% endhint %}

{% hint style="info" %}
**In Herd:** Create a smishing simulation by choosing SMS as the delivery channel, then customize the message and link destination.
{% endhint %}

#### What to Track

| Metric                        | What It Measures                                        |
| ----------------------------- | ------------------------------------------------------- |
| **Link click rate**           | The SMS equivalent of email click rate                  |
| **Report rate**               | Percentage of employees who flagged the suspicious text |
| **Follow-up completion rate** | Training completion after a failure                     |

***

### Putting It All Together

{% hint style="success" %}
The strongest programs treat simulations as **structured practice**, not pop quizzes. When you pick realistic scenarios, avoid cheap emotional hooks, and clearly explain what you were testing — people understand that the goal is to help them handle real threats, not to call them out.
{% endhint %}

In Herd, you can run coordinated phishing and smishing simulations, automatically trigger follow-up training, and use your results over time — clicks, reports, escalations — to tune difficulty rather than to shame individuals. That steady calibration is what builds long-term trust in your security team and real confidence in spotting attacks.