> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/simulations/phishing-simulations.md).

# Phishing Simulations

Run realistic phishing and social engineering simulations with Herd to train your team, build awareness, and track resilience.

## Overview of Simulations

You're ready to start running phishing simulations! Herd makes it simple to test and train your team against real-world social engineering threats, so you can build awareness without disrupting daily workflows. Whether you're simulating phishing emails, SMS messages, or even AI voice-cloning deepfakes, Herd ensures your team gains practical experience recognizing and responding to attacks.

Open **Simulations** in the left-hand sidebar to land on the email **Campaigns** list. **Simulations** expands in the sidebar to list the channels — **Email**, **SMS**, **WhatsApp**, and **Voice** (channels your plan does not include are hidden or shown locked). The same header holds the **Reviews** and **Reports** buttons, the section's **New** action, and the settings gear, so they stay in one place as you move between tabs.

This section provides step-by-step instructions for building new simulations and how to use them effectively. You'll be able to plan, launch, and track simulations with ease, helping your team stay alert and resilient.

### What You'll Find Here

* [**Navigating the Phishing Simulations Page**](/herd-security-docs/simulations/phishing-simulations/navigating-phishing-simulations-page.md): find your way around the section header, the template library, and campaigns.
* [**Allowlisting Email Domains (Google Workspace)**](/herd-security-docs/simulations/phishing-simulations/allowlisting-email-domains.md): allowlist Herd's sending domains in Google Workspace so simulations land in every user's inbox.
* [**Allowlisting Email Domains (Microsoft 365)**](/herd-security-docs/simulations/phishing-simulations/allowlisting-email-domains-microsoft-365.md): allowlist Herd's sending domains in Microsoft 365 with Defender Advanced Delivery.
* [**Creating Email Templates**](/herd-security-docs/simulations/phishing-simulations/creating-email-templates.md): design realistic phishing email templates, organize them with tags and collections, and star your favorites.
* [**Landing Pages**](/herd-security-docs/simulations/phishing-simulations/landing-pages.md): build the pages users see after they click, including credential-capture tracking.
* [**Create Campaign**](/herd-security-docs/simulations/phishing-simulations/create-campaign.md): build a campaign from hand-picked templates, a collection, or a tag; set the audience and delivery; run it once or on an ongoing cadence.
* [**QR Code Phishing**](/herd-security-docs/simulations/phishing-simulations/qr-code-phishing.md): add scannable QR codes to templates to simulate "quishing" attacks.
* [**Campaign Results**](/herd-security-docs/simulations/phishing-simulations/campaign-results.md): track per-person outcomes, understand how Herd filters out security-scanner traffic, and review program-wide reports.
* [**Auto-generated Simulations**](/herd-security-docs/simulations/phishing-simulations/auto-generated-simulations.md): let Herd generate fresh templates nightly from your app stack and reported threats.

#### Email Simulations

* Users receive a **realistic phishing email** designed to mimic common attack techniques.
* If a user clicks on a suspicious link or fails to report the email, Herd provides **real-time feedback and education**.
* Email simulations help strengthen awareness around **links, attachments, and sender authenticity**.

#### Other Channels

The pages above cover email. The other simulation channels have their own guides:

* [**SMS Phishing (Smishing) Simulations**](/herd-security-docs/simulations/sms-phishing-smishing-simulations.md)
* [**WhatsApp Phishing Simulations**](/herd-security-docs/simulations/whatsapp-phishing-simulations.md)
* [**Voice Simulations**](/herd-security-docs/simulations/voice-simulations.md): an AI voice calls your team with a pretext and asks them to read back a code they were just texted.
* [**Deepfake Phishing Simulations**](/herd-security-docs/simulations/deepfake-phishing-simulations.md): a voice-cloning exercise delivered inside a training, and training videos featuring an AI likeness of your own executives.