Phishing Awareness Training Template and Checklist
A ready-to-run phishing program with a simulation cadence and a report-fast habit. Train every team, then measure who clicks and who reports.
Reviewed by Abhijit Rao, AVP & Business Head, India
- A seven-module phishing program, from bulk phishing to BEC
- A simulation checklist covering baseline, cadence and follow-up
- A team readiness matrix across identify, report, links, spear-phishing and BEC
- A quarterly simulation calendar and a report-rate target
What is inside
- A seven-module phishing program, from bulk phishing through spear-phishing to business email compromise.
- A 10-point simulation checklist covering baseline, cadence, the report button and follow-up.
- A team readiness matrix that scores each team on identifying, reporting and resisting targeted attacks.
- A quarterly simulation calendar and a report-rate target so the habit keeps improving.
Who it is for
Anyone who has to plan what people learn, and answer for whether it landed.
- L&D and training teams
- People managers and team leads
- Heads of function and department
- HR business partners
- Compliance and risk teams
- Onboarding and enablement teams
- Operations and delivery leads
- COOs and HR directors
How to use this template in 4 steps
- Pick your format. Download the PDF to share, the Word file to edit, or the Excel file to work in live. All three are free.
- Make it yours. Adapt the sections, fields and wording to your team, roles and process so it fits how you actually work.
- Put it to work. Fill it in, circulate it to stakeholders for sign-off, or roll it out to your team.
- Track and improve. Review it on a set cadence and refine it as your goals, roles and priorities change.
What is inside
- A seven-module phishing program, from bulk phishing through spear-phishing to business email compromise.
- A 10-point simulation checklist covering baseline, cadence, the report button and follow-up.
- A team readiness matrix that scores each team on identifying, reporting and resisting targeted attacks.
- A quarterly simulation calendar and a report-rate target so the habit keeps improving.
Adapt the modules and checklist to your own security policy and control framework. This is a starting structure, not a substitute for your security team's requirements.
The training program template
Seven modules that move from spotting an obvious scam to resisting a tailored one aimed at a named person. Run the full set for new joiners, then rotate the targeted modules for high-risk roles.
| Module | Audience | Duration | What it must cover |
|---|---|---|---|
| 1. Anatomy of a phishing email | All staff | 20 min | How phishing works, why it still succeeds, and the shape of a typical lure. |
| 2. The red flags | All staff | 20 min | Sender mismatch, urgency, odd links, attachments, and requests for money or credentials. |
| 3. The report button | All staff | 10 min | Where it is, how to use it, and why reporting a suspicious email always beats deleting it. |
| 4. Links, attachments and lookalikes | All staff | 20 min | Hovering links, lookalike domains, QR-code lures, and safe handling of attachments. |
| 5. Spear-phishing and targeting | High-risk roles | 30 min | Personalised lures, pretext research, and why executives and assistants are prime targets. |
| 6. Business email compromise | Finance, execs, assistants | 30 min | Invoice fraud, urgent payment and gift-card scams, and the callback rule for money requests. |
| 7. Smishing, vishing and refresher | All staff | 20 min | Text and phone scams, a recent anonymised example, and a short knowledge check for evidence. |
Delivering the modules and simulations through an LMS gives you dated completion and report rates per person and per team, the evidence an auditor or a cyber-insurer asks for.
The simulation checklist
Ten steps to run phishing simulations that lift reporting, not just catch people out. Tick items to track your own progress, it stays in this browser. The download has the same list with an owner column.
- Baseline simulation run before any trainingTestingBefore launch
- Report button installed in every mailboxToolingOngoing
- Red-flag module completed by all staffAwarenessPer hire
- New joiners trained within their first weekOnboardingPer hire
- Simulations scheduled and variedTestingQuarterly
- Spear-phishing scenarios used for high-risk rolesRole-basedQuarterly
- BEC and payment-fraud drilled with financeFinanceQuarterly
- Reporters thanked, clicks never punishedCultureOngoing
- Report rate tracked by team, not just click rateGovernanceOngoing
- Real lures turned into follow-up simulationsTestingOngoing
The most common gap is the last two. Chasing a low click rate while ignoring report rate trains people to stay quiet, which is exactly what an attacker wants.
Team readiness at a glance
The checklist tells you what is missing overall. This matrix tells you which teams click and which report. Score each team on the five behaviours that carry the most risk. In Excel the readiness and gaps calculate as you type.
| Team | People | Identify | Report | Links | Spear | BEC | Ready |
|---|---|---|---|---|---|---|---|
| Engineering | 180 | 2 | 2 | 2 | 2 | 2 | 100% |
| Sales | 120 | 1 | 1 | 2 | 1 | 1 | 60% |
| Finance | 60 | 2 | 1 | 1 | 1 | 0 | 50% |
| Support | 90 | 2 | 2 | 1 | 1 | 1 | 70% |
| Executive office | 20 | 1 | 1 | 1 | 0 | 1 | 40% |
| Coverage at required | 60% | 40% | 40% | 20% | 20% | 64% |
Finance and the executive office are the exposure here: weak on BEC and spear-phishing, which is exactly the pairing that invoice-fraud and CEO-fraud attacks exploit.
The quarterly simulation calendar
| Timing | Action | Owner |
|---|---|---|
| On joining | Red-flag module and the report button in the first week, recorded. | L&D and IT |
| Monthly | Review click and report rates by team, and any real lures seen. | Security |
| Quarterly | Run a phishing simulation and a short follow-up nudge, tracked per team. | Security |
| Quarterly, high-risk roles | Spear-phishing and BEC scenario for finance, execs and assistants. | Security |
| Annual, all staff | Refresher module and knowledge check, tracked per team. | L&D |
| After any real incident | Targeted micro-training and a matching simulation, fast. | Security |
How to run it
- Baseline before you train
Run one simulation before any training so you can show the change afterwards, not just a raw number.
- Install and train the report button
One click to report should be the easiest action in the inbox, and everyone should know it exists.
- Teach red flags, not fear
Sender, urgency, links and requests for money or credentials. Recognition beats caution alone.
- Escalate the difficulty
Move from bulk phishing to spear-phishing and BEC for finance, executives and their assistants.
- Reward reporting, not silence
Thank reporters, publish the report rate, and never punish a click that was reported fast.
- Review click and report rates monthly
Track both by team, and turn any real lure into next month's simulation.
Frontline teams reach 45 percent-plus completion on Disprz when training is delivered in short, mobile modules, the format this program is built for.
Common mistakes this pack prevents
- Chasing a low click rate while ignoring whether anyone reports, which trains silence.
- One generic simulation for everyone, when finance and executives face tailored attacks.
- No report button, so a suspicious email gets deleted instead of flagged.
- Punishing people who click, which guarantees the next click is hidden.
- No dated records, so there is nothing to show an auditor or cyber-insurer.
Which format should you use?
| Format | Best for | What is inside | Editable | Size |
|---|---|---|---|---|
| Sharing and print | The full template, formatted to print or circulate | No | 54 KB | |
| Word | Editing the wording | Every section as editable text you can adapt | Yes | 86 KB |
| Excel | Filling it in live | The grid and fields set up as a working spreadsheet | Yes | 65 KB |
Questions people ask
Is phishing awareness training mandatory?
Should I measure click rate or report rate?
How often should we run phishing simulations?
Can I adapt the modules and checklist?
Do I have to fill the form three times?
A phishing program is only a control if people report fast. That is the part we run.
Bring your teams to a 30-minute working session. We will show how Disprz delivers phishing training in short mobile modules and rolls report rates up by team, so your next audit or board update is a two-minute export.