Lesson 3.76: Running phishing simulations ethically
A phishing simulation tests people, so it has to treat them fairly or it destroys the trust the programme depends on. Well-run programmes agree written rules with HR, legal and employee representatives: no lures that cause real distress, no collection of real passwords, results used for learning and not for punishment, and the same rules for executives as for everyone else. In the lab you check next quarter's campaign plan against Northwind's charter, find five violations and produce a corrected plan that can go to the Works Council.
15 min
You will learn to
- Explain why simulations need agreed rules
- Recognise lures that cross ethical lines
- Check data handling (no stored passwords, limited reporting, retention)
- Check scope and approvals
- Produce a corrected plan with jq
Key terms
- Simulation charter
- Written rules for phishing tests agreed with HR, legal and staff representatives.
- Works council
- Elected employee representatives; in several EU countries they must agree to monitoring of staff.
- Data minimisation
- Collect only what the purpose needs (GDPR Art. 5).
- Distressing lure
- A lure built on pay, health, job loss or family that causes real harm when it turns out to be fake.
- Teachable moment
- A short explanation shown right after someone clicks a simulation.
← Supply-chain attacks: when trusted software turns · All lessons · Security roles and RACI →