Phishing simulations and awareness training: Do you need both?

Phishing simulations and security awareness training are related but distinct activities. Many organizations run simulations and assume they have satisfied their training requirement. Others deliver training but never test whether it worked. Neither approach is complete on its own. Here is how the two complement each other, what compliance frameworks expect, and how to build a program that covers both.

What security awareness training does

Training educates employees about threats, policies, and safe practices. It is structured, comprehensive, and covers a range of topics including phishing, passwords, data handling, and incident reporting. Good training changes behavior by explaining why practices matter, not just listing rules. It typically happens annually and is required by frameworks like HIPAA, PCI DSS, and the FTC Safeguards Rule. For a broader look at what a program should include, what it costs, and how to roll it out, see how to choose online cybersecurity training.

What phishing simulations do

Simulations test whether employees can recognize phishing emails in practice. They send realistic but harmless fake phishing messages and track who clicks, who reports, and who ignores them. The results show where additional training is needed. Simulations are a measurement tool and a reinforcement mechanism, not a replacement for formal training.

Why you need both

Training without testing is unverified. You have no way to know whether employees actually learned what you taught. Testing without training is unfair. You are measuring performance on a skill you never taught. Together, they create a feedback loop: train, test, identify gaps, retrain, and retest. This is the approach used by mature security programs and increasingly expected by auditors and insurers, and the underlying evidence for why it works is explored in does security awareness training reduce security incidents.

What frameworks expect

HIPAA, PCI DSS, the FTC Safeguards Rule, and SOC 2 all require formal security awareness training. None of them explicitly require phishing simulations, but many auditors and QSAs ask about them as evidence of a mature program. Cyber insurance applications increasingly ask whether simulations are conducted. Running simulations alongside formal training strengthens your compliance posture and your insurance position.

How to implement both efficiently

For small and mid-sized organizations, the key is simplicity. Deliver annual training that covers all required topics, then run a few phishing simulations throughout the year to reinforce learning and measure improvement. Track results over time to show progress. Document everything: training completions, simulation results, and any remedial actions taken. A platform that handles both training delivery and simulation tracking simplifies this significantly.

When to start

If you have neither training nor simulations, start with training. It satisfies your compliance requirements and builds the foundation. Add simulations once the training is in place and employees have had time to absorb the material. If you already run simulations but lack formal training, add the training immediately. You are testing on a skill you have not taught, which produces poor results and does not satisfy any framework requirement.