Overview
Phishing simulation tools help security teams assess how users respond to simulated attacks and identify users who require additional training based on results. Threat-based simulations, targeted follow-up and behavioural insights help teams reinforce safer choices and track changes in user risk.
Prepare employees with simulations based on current threats, including attacks targeting your own organisation.
Use simulation behaviour, role and risk signals to automatically deliver effective follow-up exercises to the right users.
Track performance, reporting behaviour and repeat actions to see where users improve and where they still need intervention.
Testing Challenges
Periodic phishing tests can show who clicks, enters credentials or reports a suspicious message. But a simulated response doesn’t give you the full picture of how that user responds to real threats or what will help them improve. Security teams need a way to turn real threats and user behaviour into targeted follow-up, then measure whether those interventions lead to lasting behaviour change.
Real-World Relevance
Proofpoint ZenGuide helps you build and run targeted phishing simulations using current attack techniques and threat intelligence. Using threats detected in your own environment, you can deliver phishing training that mirrors the real-world attacks targeting your organisation.
Threat-Based Simulations
Keep phishing training current with scenarios based on real-world threats and evolving attack techniques.
Multi-Channel Coverage
Prepare users for social engineering across email and other attack vectors, including SMS, QR codes and more.
See how AI ThreatFlip transforms a phishing attack into a safe simulation template.
Tailored Experiences
Determine what individual users or groups need next by evaluating simulation behaviour alongside broader risk signals. Reinforce missed phishing indicators in context, then auto-enrol users in targeted learning based on their behaviour, roles and risk profiles.
Teachable Moments
Give users immediate, contextual feedback on phishing indicators they miss and explain the techniques behind them.
Adaptive Learning Assessments
Identify specific knowledge gaps with targeted assessments so you can reinforce the skills each user needs to improve.
Build automated learning paths that route users to appropriate follow-up and adjust as their behaviour changes.
Progress Tracking
Move beyond individual test results to understand phishing behaviour in a broader risk context. Connect awareness, behavioural and threat signals to identify persistent challenges, measure progress and determine where your programme needs to intervene next.
Phishing Behavior Reporting
See trends in clicks, reporting accuracy, repeat behaviours and other phishing performance metrics.
User Risk Scores
Identify users who need more attention by putting phishing performance in context with behavioural and threat exposure signals.
Security Program Score
Track your security awareness training programme’s outcomes to see what’s working and where to adjust.
Industry Benchmarking
Compare your programme’s performance with industry peers to understand results in a broader context.
Why Proofpoint
| Capability | Traditional phishing tests | ZenGuide |
|---|---|---|
| Threat relevance | Test user response to selected simulated phishing scenarios | Uses current threat intelligence and attacks detected in your environment to prepare users for relevant threats |
| In-context learning | Capture the user's response for evaluation | Reinforces missed phishing indicators in context so users can learn from their decisions |
| Targeted follow-up | Provide test results that teams can use to plan next steps | Uses behaviour, role and risk signals to automatically deliver relevant training and reinforcement |
| Adaptive learning | Provide test outcomes that can inform subsequent training | Uses assessments and adaptive learning paths to address specific knowledge and behaviour gaps |
| Risk context | Show user behaviour within the phishing test | Connects phishing performance with broader risk signals to help prioritise intervention |
| Progress measurement | Track performance across phishing tests | Tracks behaviour trends, user risk, programme progress and benchmarks to show where improvement is happening |
Customer Stories
"User awareness training is working. Halifax Health now has an extremely low malicious-link click rate of 1% to 2% among its 4,000 employees."
Tom Stafford
VP and CISO, Halifax Health
"Our employee phishing click index remains at industry-best levels, at or below 15 clicks per 100,000 attacks... And our employees continue to show improved phishing awareness."
Global Threat Leader
Fortune 100 Manufacturing Company
"[ZenGuide] improves awareness among our employees and gives them the tools they need to recognise attack techniques and report them."
ICT Security Team Lead
Ariston Group
Request a Demo
A Proofpoint cybersecurity specialist will contact you shortly.
Recommended for You
A phishing simulation is a controlled security exercise that sends simulated phishing attacks to employees to test how they recognise, respond to and report suspicious messages. Effective simulations use these results to guide phishing training, reinforce safer behaviour, and measure improvement.
Look for phishing simulation tools that reflect current threats, support targeted follow-up and measure changes in user behaviour. The strongest solutions can also help you identify who needs additional training and adapt learning based on behaviour, role and risk.
No single simulation schedule fits every organisation. Run phishing simulations regularly enough to reinforce skills while adapting them as cyberthreats, user behaviour and organisational risks change. Users or groups with higher risk profiles may also benefit from more targeted reinforcement.
Use phishing simulation results to identify behaviours and knowledge gaps that need attention. Combined with role and risk signals, these insights can guide targeted training, reinforce missed phishing indicators and adapt learning to each user’s needs instead of assigning the same follow-up to everyone.
Measure more than click and failure rates. Reporting behaviour, repeat actions, phishing performance trends, knowledge gaps and user risk can help show whether training is changing behaviour. Programme-level trends and benchmarking can provide additional context for measurable results.
Phishing simulations are more relevant when they reflect the threats users actually face. Current threat intelligence and attacks detected in your environment can inform relevant scenarios, while targeted follow-up helps users practise recognising and responding to tactics they may encounter again.
