Segment Phishing Simulations by Department (2026 Guide)
Learn how to segment phishing simulations by department risk level with tiered cadences, templates, and reporting for 2026 security awareness programs.
DefendWise
DefendWise
Segmenting phishing simulations by department risk level turns one generic campaign into five or six targeted ones — and it's the difference between a report that shows real risk and one that just shows an average.
TL;DR
- Segment phishing simulations by department because finance and HR click at 2-3x the rate of IT staff in most 2026 benchmark data.
- Group departments into 3-4 risk tiers, not 20 individual buckets, or the admin work eats the value.
- Match template difficulty to department risk: wire-transfer lures for finance, W-2 lures for HR, credential lures for everyone else.
- DefendWise's flat-fee, unlimited-seat model removes the cost penalty MSPs usually hit when segmenting by department.
- Re-score every quarter — department risk shifts when headcount, tools, or process changes.
Why this matters
A single company-wide phishing test tells you the average click rate. It does not tell you that accounts payable clicked on 41% of invoice-themed lures while engineering clicked on 6% of the same campaign. Averages hide the department that's actually going to cause the breach.
MSPs running security awareness training across multiple subclients in 2026 face a specific version of this problem: seat-count pricing on most platforms makes department-level segmentation expensive, because every extra campaign group can trigger extra per-seat charges. Flat-fee platforms remove that penalty, which is why segmentation by department is becoming standard practice instead of an enterprise-only feature.
The goal isn't more campaigns. It's fewer, better-targeted campaigns that map to where the actual risk sits.
What you'll need
- An employee directory with department field populated — HR systems or your PSA/RMM sync usually have this already
- Historical phishing simulation software results if you have them, even 60-90 days of click data
- A phishing simulation tool for HR teams-style template set, or access to a shared phishing simulation tool for HR teams library and a separate phishing simulation tool for IT departments set
- A risk-tiering framework — three or four tiers is enough for most organizations under 500 employees
- 30-45 minutes per client to build the initial segmentation, less on repeat cycles
The steps
1. Pull department data and clean it
Export the full employee list with department, title, and email. Messy department fields are the number one reason segmentation projects stall — "Finance," "Accounting," and "AP" are the same group but will split your data three ways if you don't normalize them first.
Expected outcome: one clean CSV with a single department column per employee. Common mistake: leaving contractors and seasonal staff unassigned — they need a tier too, usually the highest one.
2. Rank departments by inherent exposure, not past performance
Before you look at click-rate history, rank departments by what they touch: finance and AP handle wire transfers and invoices, HR handles W-2s and direct-deposit changes, and executives are named targets for business email compromise. IT and engineering typically sit lower because they're trained to scrutinize links by default.
This matters because a department with a low historical click rate but high exposure (say, a finance team that's never been tested) still needs a high-risk tier. Waiting for a bad click rate before treating a department as high-risk is backwards.
3. Build three or four risk tiers
Tier 1 (highest risk): finance, HR, executives, anyone with wire or payroll authority. Tier 2: sales, customer service, front-desk or reception roles that get high external email volume. Tier 3: general staff and operations. Tier 4 (lowest, optional): IT and security teams who get harder, more targeted simulations instead of easier ones.
Four tiers is the ceiling for most organizations. More than that and the admin overhead of managing separate campaigns, separate templates, and separate reporting outweighs the precision gained.
4. Match template difficulty and theme to each tier
Tier 1 gets high-fidelity, business-context lures: fake wire approval requests for finance, fake benefits enrollment or direct-deposit changes for HR. Tier 2 gets moderate-difficulty lures tied to their daily workflows — shipping notifications, CRM alerts, calendar invites. Tier 3 gets baseline generic phishing templates. Tier 4 gets the hardest simulations you have, since IT staff are your last line of defense.
A phishing template library organized by difficulty and theme makes this step fast instead of a rebuild every quarter.
5. Set separate cadences per tier
Tier 1 runs monthly. Tier 2 runs every six weeks. Tier 3 runs quarterly. Running everyone on the same monthly schedule wastes simulation credits on low-risk groups and under-tests the departments that actually need pressure.
Expected outcome: a calendar where finance sees 12 simulations a year and general staff see 4. Common mistake: syncing all tiers to the same send date — it lets employees warn each other across departments the moment the first tier gets hit.
6. Benchmark each tier separately, not against a company-wide average
Compare finance's click rate against finance's own trend line and against industry benchmarks for finance-specific lures, not against the whole company's number. A benchmarking approach built around peer groups catches a department drifting upward well before it shows in the aggregate.
7. Report results by department, not by headcount total
When you brief leadership or an MSP client, show the tier breakdown: "Finance: 8% click rate, down from 22% in Q1 2026. General staff: 4%, flat." That framing shows exactly where the training budget is working and where it isn't. A structured approach to communicating phishing simulation results to leadership turns this into a five-minute conversation instead of a spreadsheet dump.
8. Re-tier quarterly
A department that reorganizes, hires a new controller, or takes on a new vendor relationship can shift risk overnight. Revisit the tier assignments every quarter alongside your regular reporting cycle, not just at annual renewal.
Segment clients without seat-count math
DefendWise runs unlimited departments and subclients for one flat fee starting at $399/month.
Troubleshooting
Department field is missing or inconsistent in the directory. Pull from the PSA or HRIS instead of relying on email signatures or self-reported titles — those drift within months.
Click rates look identical across tiers after three cycles. The templates probably aren't differentiated enough by difficulty. Pull harder lures for Tier 1 and confirm Tier 3 isn't accidentally getting the same set.
Leadership pushes back on why finance gets tested more often than everyone else. Show the exposure argument, not the click-rate argument — finance handles wire transfers, and that alone justifies a tighter cadence regardless of past performance.
Small departments (2-3 people) skew the tier's click rate wildly. Combine small high-risk departments (e.g., a two-person AP team and a three-person payroll team) into one tier group rather than reporting them separately.
Contractors and seasonal staff fall through the cracks. Assign them to Tier 1 or Tier 2 by default until you have data — new and temporary staff click at higher rates in most 2026 industry data, and skipping them defeats the point of segmentation.
MSP is managing this across 15+ subclients and it's becoming a full-time job. This is the exact scenario a flat-fee, multi-tenant platform is built for — segmentation shouldn't cost more per department, and it shouldn't take a dedicated headcount to manage.
Tools and resources
- Phishing simulation tool for HR teams for building the Tier 1 HR-specific lure set
- Phishing simulation tool for IT departments for the hardest, lowest-tier simulations
- How to build a phishing template library for simulations to organize templates by difficulty tier
- How to benchmark employee phishing susceptibility rates for peer-group comparisons instead of company-wide averages
- A directory export tool (PSA, RMM, or HRIS) to normalize department fields before tiering
What to do next
Once departments are tiered and cadences are running, the next problem is proving the program is working over time. How to communicate phishing simulation results to leadership covers how to turn tiered click-rate data into a report a client or executive team actually reads.
FAQ
What's the best way to segment phishing simulations by department?
Rank departments by inherent exposure to wire, payroll, and credential risk first, then build 3-4 risk tiers rather than one campaign per department. Match template difficulty and cadence to each tier and re-check the tiers every quarter.
Is department-based segmentation better than company-wide phishing tests?
Yes for organizations over roughly 50 employees, because company-wide averages hide departments with dangerously high click rates. Finance and HR typically click at 2-3x the rate of IT staff, and a single average masks that gap.
How many risk tiers should a phishing simulation program use?
Three or four tiers covers most organizations under 500 employees. More tiers add admin overhead in template management and reporting without meaningfully improving precision.
How much does department-level phishing simulation cost in 2026?
Cost depends on the platform's pricing model — per-seat platforms often charge more as you add campaign groups, while flat-fee platforms like DefendWise charge one price regardless of how many departments or subclients are segmented.
Which department should get the hardest phishing simulations?
IT and security teams should get the hardest, most targeted lures since they're the last line of defense, even though their historical click rates are usually the lowest in the company.
How often should high-risk departments be tested?
Tier 1 departments like finance, HR, and executives should run monthly simulations in 2026, while lower-risk general staff can run on a quarterly cadence.
Should contractors and seasonal workers be segmented separately?
Yes, assign them to a high-risk tier by default rather than leaving them unassigned. New and temporary staff typically show higher click rates than tenured employees in most industry benchmark data.
Can MSPs segment phishing simulations across multiple subclients without extra cost?
Flat-fee, unlimited-seat platforms let MSPs build unlimited department tiers across every subclient for one monthly price, avoiding the per-seat charges that make granular segmentation expensive on legacy platforms.
One last thing
Most programs that skip department segmentation don't fail because the idea is wrong — they fail because per-seat pricing makes each new campaign group cost more, so nobody builds past one company-wide test. Fix the pricing model first and the segmentation problem mostly solves itself.