Phishing Simulation Campaign Review

This template documents the full review of a phishing simulation campaign, from the lure used and who was targeted to click rate, report rate, failers, and remedial training completion. It is meant to capture the outcomes that matter for security awareness decisions, not just a raw scorecard. Use it after each campaign to keep a consistent record of risk patterns and follow-up actions.

It is designed for one campaign review, but it works best as part of an ongoing phishing simulation program. Repeating the same structure across campaigns makes it easier to compare click rates, report rates, repeat failers, and changes in behavior over time. That consistency also helps you see whether training changes are actually improving outcomes.

Security awareness, IT security, or the phishing program owner should complete it, usually with input from HR, compliance, or department leaders when follow-up actions are needed. If remedial training is automated, the reviewer should still confirm that assignments, deadlines, and completion tracking were handled correctly. The goal is to create one accountable record of what happened and what was done next.

It includes a specific section for identifying repeat failers and documenting the escalation plan for those individuals. That matters because repeat failure often changes the response from simple awareness training to manager involvement, targeted coaching, or additional controls. The template helps you record that decision clearly without overreacting to a single mistake.

The most useful metrics are open rate, click rate, report rate, number of failers, and remedial training completion. Those measures show both exposure and response: who engaged with the lure, who recognized and reported it, and whether follow-up training actually happened. The template also prompts you to compare results against your acceptable risk threshold and prior campaign performance.

Yes. You can adapt it for credential-harvest emails, attachment-based lures, invoice scams, password reset messages, or executive impersonation simulations. The structure stays the same, but the red flags, failure patterns, and recommended next steps should match the specific lure type and audience.

It can be paired with your phishing simulation platform, LMS, ticketing system, or security awareness dashboard. Many teams use it as the narrative layer that explains the numbers exported from those systems and records the actions taken after the campaign. That makes it easier to audit the campaign later and to brief stakeholders without stitching together multiple reports.

A common mistake is focusing only on click rate and ignoring report rate, remediation completion, or repeat failers. Another is failing to document what red flags were present in the lure, which makes later tuning harder. It is also important not to treat one campaign as a standalone verdict; the value comes from comparing campaigns and adjusting the program.

An ad hoc note usually captures only the headline result and loses the follow-up details that drive improvement. This template keeps the same review fields every time, so you can compare campaigns, track escalation, and document training completion in one place. That consistency is especially useful when multiple departments or repeat failers are involved.