Practice — run a phishing simulation campaign — Offensive Security & Penetration Testing

What You'll Build

In this exercise you will plan and run an authorized phishing-simulation campaign end to end, from securing approval to delivering supportive training, using the ethical framework from Lesson 21. The deliverable is a complete, responsibly run awareness exercise: an authorized program, a controlled simulation confined to the approved audience, aggregate engagement metrics, immediate blame-free education for anyone who engages, and a report that shows how the results will strengthen the organization's human defenses over time.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

Explicit organizational authorization and leadership support for the simulation, from Lesson 21, the ethical and legal foundation before anything else.
The defensive social-engineering understanding from Lesson 20, especially recognizing manipulation and the importance of a blame-free culture.
Familiarity with how GoPhish structures a campaign, from Lesson 21, into authorized groups, an approved scenario, and engagement tracking.
A supportive follow-up training plan prepared in advance, so anyone who engages receives immediate, blame-free education.
Agreement to handle individual results privately and report only aggregate awareness metrics, treating employees as partners to strengthen.

Setup & Project Structure

Begin only with documented authorization; without it, do not proceed. Set up a workspace to hold the program's plan, the approved scope, the aggregate metrics, and the training follow-up, keeping individual results private throughout. As with every engagement in this course, the documentation is central: it records that the exercise was authorized, ethically designed, and tied to supportive training, which is what distinguishes a legitimate awareness campaign from an inappropriate one.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Authorized awareness program only. Documentation comes first.
mkdir phishing-sim && cd phishing-sim
mkdir program metrics training

# Record authorization and purpose as the foundation of record.
cat > program/authorization.txt <<'EOF'
AUTHORIZED PHISHING SIMULATION
  approved_by:  leadership / security program owner
  purpose:      measure awareness, improve training (NOT punish)
  scope:        agreed employee group only
  follow_up:    immediate blame-free training for anyone who engages
  data:         aggregate reporting; individual results kept private
EOF
cat program/authorization.txt

Step 1 — Define the Program and Scope

With authorization in hand, define the campaign's purpose, audience, and success measures, all framed around awareness rather than catching people out. Decide which approved employee group is included, what aggregate metrics you will track, and how results will feed training. Crucially, prepare the supportive follow-up before sending anything, so education is ready the moment anyone engages. This planning, not the sending, is where a responsible campaign is truly made.

Analogy🏏Cricket

💰 Think of it like finance: A sound budget is decided before any money moves, who it covers, what targets define success, and how the results will guide next quarter, with the support plan for any shortfall ready in advance. Just as that upfront planning, not the spending, is where financial discipline is truly made, defining the campaign's purpose, authorized audience, aggregate measures, and prepared blame-free training, before anything is sent, is where a responsible campaign is truly made. Just as a good plan frames results as guidance rather than blame, this one frames everything around awareness rather than catching people out. This reveals that the plan, not the send, decides the outcome.

bash

# Define the program BEFORE any message is sent.
cat > program/plan.txt <<'EOF'
PROGRAM PLAN
  audience:   approved employee group (authorized scope only)
  purpose:    build awareness; measure resilience over time
  metrics:    AGGREGATE engagement rate (no individual shaming)
  follow-up:  training module ready NOW for anyone who engages
  tone:       supportive, blame-free throughout
EOF
cat program/plan.txt

Step 2 — Configure the Controlled Simulation

Using GoPhish within your authorized program, configure the campaign's components: the approved employee group, the sending profile, and engagement tracking, confined strictly to the authorized audience. The simulated scenario itself is designed by the security team under approval to educate rather than to cause real harm, and is clearly a controlled internal test. Verify every setting keeps the exercise within scope and measurable before proceeding, exactly the scoping discipline emphasized throughout this course.

Analogy🏏Cricket

💼 Think of it like business: A responsible pilot program is ring-fenced to an approved set of customers, with every process configured so nothing leaks beyond that group and each outcome is cleanly measured. Just as the pilot is bounded to its authorized participants and designed to inform rather than disrupt the wider business, the simulation's group, sending profile, and tracking are confined strictly to the authorized audience, with the scenario built to educate, not to cause real harm. Just as a careful manager verifies every setting before launch, you verify every setting keeps the exercise in scope and measurable. This reveals that disciplined scoping is what keeps a controlled test controlled.

bash

# Configure within the AUTHORIZED program (GoPhish components).
cat > program/campaign_config.txt <<'EOF'
CAMPAIGN CONFIG (authorized scope only)
  group:        approved employee list (nothing outside scope)
  scenario:     approved, educational, clearly a controlled TEST
                (designed to teach, never to cause real harm)
  sending:      controlled internal sender for the exercise
  tracking:     AGGREGATE engagement only
  verify:       every setting confined to the authorized audience
EOF
cat program/campaign_config.txt

Step 3 — Run, Measure, and Educate

Launch the campaign to the authorized group and collect aggregate engagement metrics. The moment anyone interacts with the simulated message, they should receive immediate, blame-free education explaining the exercise and reinforcing how to recognize such attempts, turning the interaction into learning. Keep all individual results private and view outcomes only in aggregate. The engagement data matters solely as a guide to where awareness training should focus, never as a means to identify or single out individuals.

Analogy🏏Cricket

🎵 Think of it like music: A choir director runs the rehearsal, listens for where the harmony slips, and the instant a singer falters offers immediate, encouraging correction, tracking only how the whole choir is progressing. Just as that on-the-spot, blame-free coaching turns each stumble into learning, the moment anyone engages the simulated message they receive immediate, blame-free education that reinforces how to recognize such attempts. Just as the director judges the ensemble's overall sound rather than singling out one voice publicly, you view outcomes only in aggregate and keep individual results private. This reveals that the data exists to guide training, never to single anyone out.

bash

# Run within scope; measure in aggregate; educate immediately.
cat > metrics/results.txt <<'EOF'
CAMPAIGN RESULTS (aggregate only)
  audience size:        <n>
  overall engagement:   <aggregate rate>   # NO individual names
  immediate action:     blame-free training delivered on engagement
  interpretation:       where is awareness weakest? -> target training
  privacy:              individual results kept private
EOF
cat metrics/results.txt

Step 4 — Report and Improve

Finish by reporting aggregate results and, most importantly, the plan to improve. Show where awareness is strongest and weakest, describe the supportive training that follows, and set expectations for tracking resilience across future campaigns. Frame everything constructively: the goal is a steadily more alert, more reporting-willing workforce, not a verdict on individuals. This forward-looking, supportive report, tied to ongoing improvement, is the true product of a responsible awareness campaign.

Analogy🏏Cricket

⚽ Think of it like sports: A coach's end-of-match review presents the team's overall stats, highlights where they were strong and where they struggled, and lays out the training plan for the next fixture, never a public verdict on one player. Just as that constructive, forward-looking review is the real product of the session, your report presents aggregate results, shows where awareness is strongest and weakest, and sets out the supportive training and resilience tracking to come. Just as the coach frames everything around getting better next time, you frame everything around a steadily more alert, reporting-willing workforce. This reveals that a supportive, improvement-focused report is the true deliverable.

bash

# Report AGGREGATE results and the improvement plan (the deliverable).
cat > training/report.md <<'EOF'
# Phishing Simulation Report (aggregate, supportive)

## Results
- Audience: approved group; engagement reported in AGGREGATE only
- Individual results: kept private (no shaming, no discipline)

## Response
- Immediate blame-free training delivered to anyone who engaged
- Targeted awareness training where results were weakest

## Improvement
- Track aggregate resilience across future campaigns
- Goal: a more alert, more reporting-willing workforce over time
EOF
cat training/report.md

Warning: This entire exercise is legitimate only with explicit authorization and a supportive, blame-free approach. Never run a simulation without approval, never use results to shame or discipline anyone, never publicly identify who engaged, and never design a scenario that could cause real harm. Keep individual results private, report only in aggregate, and pair every engagement with immediate education. A campaign that punishes or endangers people betrays its purpose and damages the security culture it is meant to build.

Extension Challenge: Strengthen the program three ways. First, plan a sequence of campaigns over time and describe how you would measure whether aggregate awareness is genuinely improving. Second, design a brief, encouraging training moment for anyone who engages, focused on recognizing manufactured urgency and verifying independently. Third, draft a one-paragraph message to leadership framing the program's value in terms of building a resilient, blame-free reporting culture.

A responsible phishing-simulation campaign runs end to end on authorization, ethics, and supportive follow-up, never on catching or shaming people.
Explicit leadership authorization and a clear awareness purpose are the foundation, documented before anything else, mirroring engagement authorization.
The program, audience, metrics, and blame-free training follow-up are all planned before any message is sent, which is where a responsible campaign is truly made.
The simulation is configured within GoPhish strictly to the authorized group, with an educational scenario designed to teach rather than cause real harm.
Results are collected and reported only in aggregate, with individual outcomes kept private and immediate blame-free education for anyone who engages.
The true deliverable is a constructive, forward-looking report tied to ongoing training that steadily builds a more alert, reporting-willing workforce.