12-Month Phishing Simulation Calendar: 2026 MSP Guide
Build a 12-month phishing simulation calendar for 2026 with baseline testing, difficulty progression, and leadership reporting MSPs can show auditors.
DefendWise
DefendWise
A 12-month phishing simulation calendar turns scattered tests into a documented program you can hand an auditor, an insurance underwriter, or a client's leadership team without scrambling. This guide lays out the month-by-month build, the difficulty progression, and the reporting cadence that makes the calendar defensible in 2026.
TL;DR
- A 12-month phishing simulation calendar needs a baseline test, monthly cadence, and quarterly reporting to hold up in 2026 compliance reviews.
- DefendWise runs unlimited-seat phishing simulations for a flat $399/month, which removes the per-test cost that usually kills a 12-month cadence.
- Segment templates by department risk before month 3 -- finance and HR need harder lures than warehouse staff.
- Skip building an incident response step into month 1 and your calendar produces clicks, not evidence.
Why this matters
A one-off phishing test tells you almost nothing. Click rates swing 5-10 points between campaigns based on template difficulty alone, so a single snapshot can make a client look either fine or terrified for the wrong reasons. A 12-month calendar fixes that by giving you a trend line instead of a data point, and a trend line is what cyber insurers, auditors, and boards actually ask for during renewal season.
MSPs running per-seat phishing tools feel this cost directly: every added employee, every new subclient, every mid-year headcount bump changes the invoice. That friction is why most shops run two or three simulations a year instead of twelve. A flat-fee model removes the math from the decision -- DefendWise charges one flat rate per MSP tenant regardless of seat count, so scheduling month 9 costs the same as month 1.
What you'll need
- An unannounced baseline test result from before you build the calendar
- A phishing template library covering at least 6 attack vectors -- credential harvest, invoice fraud, HR/payroll lures, MFA fatigue, QR-code (quishing), and executive impersonation
- A platform that supports scheduled sends across 12 months without a per-test or per-seat re-bill
- A department-level risk map naming finance, HR, executives, and IT as higher-priority segments
- A standing 15-30 minute monthly review slot with the client or internal stakeholder
- Roughly 2-4 hours a month total: scheduling, reviewing results, and adjusting difficulty
The steps
1. Run an unannounced baseline test in month 1
This gives you the number every later month gets compared against. Send a mid-difficulty template -- not the easiest one you have, not a zero-day-style lure -- to the full user population with no advance notice. Expect the baseline click rate to land anywhere from 10% to 30% depending on prior training exposure; write that number down before you touch the calendar.
Common mistake: warning department heads in advance. That inflates the baseline and makes every subsequent month look like fake progress.
2. Build the template library before you schedule anything
Don't pick campaigns month-by-month as you go -- map the full year's templates in one sitting so difficulty and theme don't repeat by accident. A phishing template library organized by attack vector and difficulty tier lets you pull the right lure for the right month instead of reusing last quarter's invoice scam because it's the only one queued up.
Expected outcome: 10-12 distinct templates mapped to months, with 2-3 held in reserve for departments that fail early and need a repeat test sooner than the calendar dictates.
3. Set a difficulty progression across the 12 months
A flat difficulty curve is the single most common reason 12-month calendars stall out by month 6 -- users stop clicking not because they've learned, but because the lure never got harder. Setting difficulty levels for realistic phishing simulations means ramping from generic mass-market lures in Q1 to spoofed-vendor and spear-phishing-style templates by Q4.
A rough curve that works: months 1-3 at low-to-medium difficulty, months 4-6 medium, months 7-9 medium-high with personalized details (name, role, recent event), months 10-12 high difficulty including at least one BEC-style test targeting finance or executives.
4. Segment simulations by department risk
Treating every employee the same wastes the calendar's most useful lever. You can segment phishing simulations by department risk level so finance and accounts payable get invoice-fraud and wire-transfer lures on a tighter cycle, while lower-risk departments run the standard monthly cadence.
Expected outcome: finance, HR, and executive segments tested twice as often as the general population by month 6, with click-rate deltas tracked separately per segment rather than blended into one company-wide number.
Run this calendar without seat-count math
One flat fee covers every client and every seat -- schedule all 12 months up front.
5. Map the calendar onto a monthly cadence grid
A visible grid keeps the calendar from drifting once the quarter gets busy. A simple version looks like this:
| Month | Theme | Difficulty | Segment focus |
|---|---|---|---|
| 1 | Baseline / generic lure | Low-Medium | All users |
| 2 | Credential harvest | Low | All users |
| 3 | HR/payroll lure | Medium | HR, all-staff |
| 4 | Vendor invoice fraud | Medium | Finance, AP |
| 5 | MFA fatigue / push bombing | Medium | IT, remote staff |
| 6 | Mid-year re-baseline | Medium | All users |
| 7 | Quishing (QR code) | Medium-High | All-staff |
| 8 | Executive impersonation | Medium-High | All-staff |
| 9 | Vendor impersonation | High | Finance, procurement |
| 10 | Seasonal (holiday shopping) | Medium | All-staff |
| 11 | W-2 / tax season prep | High | Finance, HR, payroll |
| 12 | Year-end BEC test | High | Executives, finance |
6. Layer in seasonal and compliance triggers
Certain months carry predictable attack spikes -- W-2 phishing peaks ahead of tax filing season, holiday shopping scams peak in November and December, and open-enrollment lures target HR in the fall. Build those into the grid rather than treating them as one-off extras; a calendar that ignores tax season is missing the month attackers actually use.
Common mistake: scheduling the tax-season test in April instead of January or February, after the real attack window has closed.
7. Automate reporting for leadership review
A calendar nobody reads stops mattering by month 4. You need a way to communicate phishing simulation results to leadership in a format that takes under five minutes to review -- click rate trend, department breakdown, and one action item per month, not a raw spreadsheet dump.
Expected outcome: a one-page monthly summary that leadership actually opens, plus a rolled-up annual report ready for a cyber insurance renewal or a SOC 2 evidence request in 2026.
8. Re-benchmark at month 12 and reset
Close the year by comparing month 12's click rate against the month 1 baseline. A drop from a 22% baseline to single digits by month 12 is a realistic target for a well-run program; anything flat year-over-year means the difficulty curve or the segmentation needs rework before you build next year's calendar.
Troubleshooting
- Click rates plateau after month 6. The difficulty curve is too flat -- jump two difficulty tiers instead of one for the next quarter.
- Employees start recognizing your sending domain. Rotate sender domains and display names every 2-3 months; reusing the same spoofed domain trains recognition instead of behavior.
- Leadership stops reading monthly reports. Cut the report to one page and lead with the trend line, not the raw numbers.
- One department fails every single test. Pull that department into a tighter 2-week cycle with easier templates before ramping difficulty back up.
- IT flags your simulation emails as spam. Whitelist the sending domain and IPs at the mail gateway before the calendar starts, not after month 3 when delivery data looks broken.
- Templates feel repetitive to users. Rotate at least 3 template variants per theme so two employees in the same department don't compare identical emails.
Tools and resources
- A phishing simulation platform that supports scheduled 12-month campaigns without per-test billing
- A template library covering at least 6 attack vectors, refreshed quarterly
- A shared calendar or project tool to track which segment gets which month's template
- A one-page reporting template for leadership review
- DefendWise's flat $399/month structure removes the seat-count math that normally forces MSPs to shrink the calendar to two or three tests a year
What to do next
Once the calendar is running, the next gap is usually evidence formatting -- auditors and insurers want more than click-rate charts. Review how to benchmark employee phishing susceptibility rates so your month-12 comparison holds up against industry data, not just your own prior year.
FAQ
How often should you run phishing simulations in a 12-month calendar?
Run at least one simulation per month, with higher-risk departments like finance and HR tested every 2-3 weeks. Monthly cadence is what most 2026 cyber insurance questionnaires expect as evidence of an active program.
What's the best difficulty progression for a 12-month phishing simulation calendar?
Start at low-to-medium difficulty in months 1-3, move to medium by mid-year, and finish months 10-12 at high difficulty with spear-phishing or BEC-style lures. A flat difficulty curve is the main reason click rates stop improving after month 6.
Is a 12-month phishing calendar better than quarterly testing?
Yes for most organizations -- monthly cadence produces a usable trend line and catches seasonal attack patterns like tax-season W-2 scams that quarterly testing often misses entirely.
How much does a 12-month phishing simulation program cost?
Cost depends on the vendor's pricing model. Per-seat platforms charge more as headcount grows across the year, while flat-fee platforms like DefendWise charge one rate regardless of how many campaigns or seats run.
Should every department get the same phishing simulation difficulty?
No -- finance, HR, and executive teams should get harder, more targeted lures like invoice fraud and BEC tests, while general staff can run on the standard monthly difficulty curve.
What click rate is realistic after a full year of phishing simulations?
A well-run 12-month program typically drops click rates from a 15-30% baseline into the single digits by month 12, though results vary by industry and starting point.
Do you need leadership reporting as part of a phishing simulation calendar?
Yes -- a monthly one-page summary with trend data is what keeps the program funded and what auditors or insurers ask to see, not just raw campaign logs.
What should the first month of a phishing simulation calendar include?
Month 1 should be an unannounced baseline test at medium difficulty sent to the full user population, run before any training or template planning begins.
One last thing
The part of a 12-month calendar that gets skipped most often isn't a template or a difficulty setting -- it's the incident response step. If month 4's simulation doesn't route into a documented "here's what happens when someone reports a real phish" process, the calendar produces click-rate charts and nothing else an auditor can use as evidence. Build the response plan into month 1, not as an afterthought in month 11.