Building a Quarterly Phishing Campaign

Overview

Quarterly phishing campaigns provide a structured approach to security awareness training. This tutorial shows you how to design, implement, and analyze progressive campaigns that measure and improve your organization's phishing resilience over time.

Step 1: Create Baseline Assessment Campaign

Start with a straightforward phishing email to establish baseline metrics. This first campaign should use obvious phishing indicators to measure your organization's current awareness level without being overly deceptive.

POST /api/campaigns/
{
  "name": "Q1 Baseline Assessment",
  "template": "generic-password-reset",
  "launch_date": "2025-01-15T09:00:00Z",
  "send_by_date": "2025-01-15T17:00:00Z",
  "groups": ["all-employees"]
}

Step 2: Design Realistic Phishing Templates

Create email templates that mirror real-world phishing threats your industry faces. Use familiar brands, realistic urgency, and appropriate tone for your organization.

• Month 1 (Baseline): Generic password reset with obvious red flags
• Month 4 (Q2): IT security update with moderate sophistication
• Month 7 (Q3): Executive impersonation with urgency
• Month 10 (Q4): Targeted spear phishing based on roles

Step 3: Schedule Progressive Difficulty Levels

Gradually increase campaign difficulty to challenge employees as they improve. Track metrics over time to measure effectiveness.

Step 4: Analyze Click-Through Rates and Trends

Track campaign results to identify trends and improvement areas. Focus on three key metrics:

• Email Open Rate: Percentage of users who opened the phishing email
• Click-Through Rate: Percentage who clicked malicious links
• Data Submission Rate: Percentage who entered credentials
• Reporting Rate: Percentage who reported the email as suspicious

GET /api/campaigns/123/results
GET /api/analytics/trends?period=12months

Step 5: Generate Compliance Reports

Create reports for auditors, executives, and compliance teams showing security awareness training effectiveness.

GET /api/reports/compliance?period=2025-Q1&format=pdf