If you want to know how likely your people are to fall for a scam, there are two common ways to find out. A phishing simulation sends staff a fake phishing email and records who clicks. A security awareness test asks people, openly, to judge real examples of scams and scores how well they do.
Both are often sold as “measuring human risk”. They are not interchangeable, and choosing the wrong one can leave you with a reassuring number that doesn’t mean much.
How a phishing simulation works
A phishing simulation platform sends employees an email designed to look like a real attack: a parcel notice, a password reset, a message from “HR”. It tracks who opens it, who clicks and sometimes who enters details. People who click are usually shown a short training page. The headline result is a click rate, tracked over time.
Simulations do some things well. They test whether your reporting process works, whether people use the report button, and how quickly your security team responds to a reported email. Those are worth checking.
Where phishing simulations fall short
- Silence counts as a pass. Anyone who never saw the email, because it was filtered, buried or they were away, is scored as if they resisted it. Your “improvement” can simply be fewer people opening.
- Opens prove nothing. Preview panes, phones and security scanners trigger “opens” on their own, and reading a message is exactly what you want people to do before they judge it.
- One template, one channel. Simulations are almost always email. Mandiant found voice phishing in 11% of investigations where the entry point was known in 2025, while email phishing kept declining, [2] and Verizon reported that mobile-based phishing simulations drew 40% more engagement than email ones. [3]
- The numbers drift. In UC San Diego’s eight-month study of more than 19,500 employees, the share who had clicked at least one phishing link rose from about 10% in the first month to more than half by the eighth, and training after a click reduced clicking by only 2%. [1] Results track the template and the timing more than people’s judgment.
- Trapping people costs trust. Deceptive tests can damage confidence in the security team, and people who feel tricked are less likely to report the next real threat.
How a security awareness test works
A security awareness test takes the opposite approach. People know they are being tested. Each person gets a link to a short, timed test made of real scam examples: messages, sign-in pages, calls, QR codes, payment requests. They judge each one, see why the answer is what it is, and get a score.
Because nothing is disguised, everyone who takes part is measured, and everyone who doesn’t is visible as “not started”. Because the examples come from many channels, you see where your people are weakest, not just whether they clicked one email. And because the experience is open, people tend to find it useful rather than humiliating.
An honest phishing simulation alternative
Scam Check is a security awareness test built from 243 questions on real scam techniques seen between 2024 and 2026, across email, text, phone, QR and more. It is scored per person and per channel, can run anonymously, and needs nothing installed.
See how Scam Check works →Side by side
| Phishing simulation | Security awareness test | |
|---|---|---|
| What is measured | Who clicked one template email | Judgment across many real scam techniques |
| People who didn’t take part | Counted as a pass | Visible as not started |
| Channels | Usually email only | Email, text, phone, QR, web and more |
| Staff experience | Deception; can cost trust | Open test with feedback after each answer |
| Who you can test | Employees in your directory | Staff, and customers via a branded link |
| Best used for | Checking reporting processes | Measuring human risk and showing progress |
Which one should you use?
If your question is “how likely are our people to fall for a real scam?”, a security awareness test answers it more directly. If your question is “does our reporting button work and how fast does the SOC respond?”, a simulation is the right tool, used occasionally and with care. Many organisations can retire monthly click-rate campaigns, measure judgment a few times a year instead, and keep a small number of simulations for process checks.
Whichever you choose, don’t rely on people alone. The UC San Diego researchers recommended refocusing on technical countermeasures. [1] Measuring judgment tells you where the gaps are; controls such as browser protection that catches brand-new phishing pages and phishing-resistant sign-in close them.
What to look for in a phishing simulation alternative
- Questions built from current, real scam techniques, refreshed regularly rather than a static template library.
- Multiple channels: text messages, voice, QR codes, fake sign-in pages and fake CAPTCHA pages, not just email.
- Scores per person, per team and per channel, with non-participation shown.
- A time budget, so results reflect judgment under pressure.
- An anonymous mode for when you need the shape of the risk without names.
- Nothing to install and invitations sent from your own address, with your branding.
- Exportable results you can show an auditor, insurer or board.
The best measure of human risk is the one that tells you the truth, even when the truth is less flattering than a falling click rate.