Phishing simulations went mainstream in 2020: Testing the human layer became a standard control

For years, security awareness training was mostly a lecture: a presentation, a video, maybe a quiz, and a certificate at the end. What it rarely included was a test of whether any of it actually worked. In 2020, that began to change. Phishing simulations, once the preserve of large enterprises with dedicated security teams, moved into the mainstream as a standard part of security awareness programs. The reason was simple: with a workforce suddenly scattered to home offices and a surge in phishing attacks, organizations could no longer afford to assume their training was effective. They needed to measure it. Here is why testing the human layer finally got serious.

Training without testing is a guess

The fundamental problem with awareness training alone is that it measures completion, not competence. An employee who sits through a session has satisfied a compliance checkbox, but whether they can actually spot a phishing email in the wild is an open question. Phishing simulations answer that question directly. By sending realistic but harmless fake phishing messages and tracking who clicks, who reports, and who ignores them, organizations get a real measurement of their workforce's resilience. The difference between assuming people learned and knowing they did is the difference between a guess and a control.

Why 2020 made it urgent

2020 accelerated the shift for obvious reasons. The sudden move to remote work expanded the attack surface and removed the informal checks that existed in an office, where a suspicious email could be flagged over a desk divider. Attackers responded with a surge of phishing tied to the pandemic, fake health alerts, stimulus scams, and counterfeit supply offers. Organizations realized that their employees were facing more threats, with fewer safeguards, than ever before. Testing whether they could handle it stopped being a nice-to-have and became a survival concern.

Simulations are a measurement, not a punishment

A common early mistake was treating simulations as a gotcha, a way to catch employees out and shame them. That approach backfired, producing resentment rather than learning. The organizations that did it well framed simulations as a measurement and a teaching tool: the goal is not to catch people but to find gaps and close them. When a simulation reveals that employees are clicking on a particular kind of lure, that is information to feed back into training, not a reason to discipline. The best programs turned the results into a feedback loop, test, learn, retrain, retest.

What good simulations look like

Effective phishing simulations share a few characteristics. They use realistic messages modeled on actual threats, including the pandemic-themed lures that were everywhere in 2020. They vary the difficulty, mixing obvious fakes with more convincing ones, so the test is meaningful rather than trivial. They track the full range of outcomes, not just clicks, but also who reported the message and who ignored it. And they are followed by immediate feedback, explaining what the tell-tale signs were, so that a click becomes a learning moment rather than a dead end.

How simulations complement training

Phishing simulations are not a replacement for formal training, they are its complement. Training provides the knowledge, and simulations test whether it has taken hold. A program that only trains never verifies. A program that only tests never teaches. Together, they create a cycle that actually improves the human layer over time: train employees on the threats, test them with realistic simulations, identify the gaps, and retrain. This is the model that mature security programs converged on in 2020, and it is the model that has stuck.

The measurement that matters

The deeper lesson of 2020 was that the human layer, like any control, needs to be measured to be managed. Phishing simulations gave organizations their first real metric for the workforce's resilience, a click rate that could be tracked over time and improved. That number, falling quarter after quarter, became one of the clearest demonstrations that a security program was actually working. In a year when everything else felt uncertain, the ability to measure the human layer, and to show it improving, was a rare point of clarity.