Phishing Simulation Difficulty Levels: 2026 Setup Guide
Set phishing simulation difficulty levels with a four-tier system and 90-day escalation schedule. Calibrate click rates correctly in 2026 — DefendWise shows how.
DefendWise
DefendWise
Set phishing simulation difficulty levels wrong and you get one of two failures: a 2% click rate that tells leadership everyone is safe, or a 40% click rate that tells leadership training doesn't work. Neither is true — the difficulty tier is broken, not the program.
TL;DR
- Four difficulty tiers — novice, intermediate, advanced, expert — replace one-size-fits-all phishing templates.
- Baseline click rate before touching phishing simulation difficulty levels or you're calibrating blind.
- Escalate difficulty over a 90-day cycle instead of hitting every user with expert-tier lures on day one.
- Segment by role: finance and HR get advanced tiers early because they're the highest-value targets in 2026.
- DefendWise runs tiered campaigns across every subclient from one console, no per-seat setup tax.
Why this matters
A phishing simulation that never gets clicked isn't training — it's a compliance checkbox with no data behind it. Auditors and cyber insurers reviewing 2026 renewals want to see a program that adapts, not a static template rotated every quarter.
MSPs running phishing simulation software for MSPs across a dozen subclients hit this fast: a construction client's office staff falls for the same lure that a law firm's paralegals spot in three seconds. Difficulty has to flex by audience, not stay fixed by template.
The fix is a tiered system with defined criteria per level, a baseline to calibrate against, and an escalation schedule. That's the rest of this guide.
What you'll need
- A baseline click-rate report from your last campaign, or 30 days of open data if this is a first run
- A template library with at least 3-4 difficulty variants per scenario (generic, branded, spear, executive-impersonation)
- User segmentation by role and risk group (finance, HR, IT, general staff, executives)
- A reporting view that separates results by tier, not just an aggregate click rate
- A platform that supports scheduled escalation without manual template swaps every cycle — this is where a flat-fee tool like DefendWise removes the seat-count math MSPs otherwise do per subclient
The steps
1. Baseline your current click rate before setting tiers
Run one untiered campaign first if you don't already have 2026 data. You need a number to calibrate against, not a guess.
A click rate above 20% on a generic template means your population needs novice-tier training before anything advanced makes sense. A rate under 5% on the same template means you're already underestimating your users and wasting simulation cycles. Common mistake: skipping baseline and jumping straight to spear-phishing templates — the resulting click rate tells you nothing because you don't know what "normal" looks like for that group.
2. Define three or four difficulty tiers with explicit criteria
Don't let "difficulty" stay a vibe. Write down what separates each tier:
- Novice — generic brand spoof, obvious sender mismatch, spelling errors, no personalization
- Intermediate — correct branding, plausible sender domain, mild urgency ("invoice overdue"), first-name personalization
- Advanced — internal-style formatting, no visible red flags, moderate urgency, references a real internal process (payroll, IT ticket)
- Expert — executive impersonation, contextual detail (recent project, vendor name), zero grammar tells, payload matches a real workflow (DocuSign, Teams link)
Skipping this step is why most SAT programs plateau — everyone runs "medium" difficulty forever because nobody defined what medium means.
3. Map your template library to those tiers
Pull from the phishing template library and tag every template by tier before you schedule anything. A template tagged "advanced" that's actually intermediate-quality will inflate your reported difficulty and confuse the click-rate trend.
Aim for at least 6 templates per tier so the same lure doesn't repeat within a 90-day cycle — repetition trains recognition of the specific email, not the pattern.
4. Segment users by risk group and phishing history
Finance, HR, and executives get advanced-tier simulations earlier because they're higher-value targets for real attackers in 2026 — wire fraud and payroll diversion attempts concentrate there. General staff start at novice and move up only after two consecutive clean cycles.
Use individual click history, not department averages, to move a specific user up or down a tier. Expected outcome: by month three, your advanced tier contains mostly finance/HR/exec users and a handful of repeat-clickers from other departments — that's the segmentation working as designed.
5. Schedule progressive escalation over a 90-day cycle
Start everyone at novice in month one, move clean performers to intermediate in month two, and introduce advanced-tier lures to your highest-risk segment by month three. Jumping straight to expert-tier in week one produces a click-rate spike that looks like a crisis but is actually a calibration error.
Escalation should follow the same cadence you'd use to run a phishing simulation campaign — monthly touchpoints, not a single annual blast.
6. Set pass/fail thresholds per tier, not one global number
A 10% click rate on an expert-tier campaign is a healthy outcome. The same 10% on a novice-tier campaign is a red flag. Track thresholds separately: novice under 5%, intermediate under 10%, advanced under 15%, expert under 25% are reasonable 2026 targets for a maturing program, though your own baseline should set the real bar.
7. Report calibrated results to leadership or subclients
A raw click-rate number without tier context misleads whoever reads it. Report tier-by-tier trend lines instead — this is the difference between a report that gets questioned and one that gets approved.
MSPs handing these numbers to subclient leadership should follow the framing in how to communicate phishing simulation results to leadership — tier context turns a scary-looking number into a defensible trend.
Run tiered phishing simulations at scale
One flat fee covers every subclient and every difficulty tier — no per-seat math.
Troubleshooting
- Click rate near zero across all tiers — your "advanced" and "expert" templates are actually intermediate-quality. Re-tag the library against the criteria in step 2.
- Click rate spikes after introducing a new tier — you escalated too fast. Drop the affected group back one tier for one cycle, then re-escalate.
- Users flag simulations as false positives to IT — a sign your intermediate tier is too close to novice; add more branding and urgency variance so templates feel distinct.
- Executives push back on being in the advanced tier — reframe it as reflecting their target value, not a punishment; pair it with the reasoning in benchmarking phishing susceptibility rates.
- MSPs managing multiple subclients lose track of which tier each client is on — this is a platform problem, not a process problem. A console that shows tier status per subclient in one view avoids the spreadsheet workaround most teams default to.
- Reported click rate doesn't match what leadership expected — check whether the report aggregates across tiers. Split it before sending.
Tools and resources
- Phishing template library guide for tier-tagging your existing templates
- Benchmarking phishing susceptibility rates to set realistic per-tier thresholds
- Running a phishing simulation campaign for the cadence that supports escalation
- Choosing phishing simulation software for MSP clients if your current platform can't segment by tier per subclient
- DefendWise's flat-fee model — unlimited seats at $399/month — removes the incentive to under-run simulations to save on per-seat billing, which is the quiet reason a lot of programs stay stuck on novice-tier templates
What to do next
Once tiers are running, the next gap is usually template variety, not difficulty. Go build out the phishing template library so each tier has enough rotation to avoid pattern-matching on a single email.
FAQ
What are the standard phishing simulation difficulty levels?
Most 2026 programs use four tiers: novice, intermediate, advanced, and expert. Each tier is defined by branding accuracy, personalization, urgency, and grammar quality, not by a subjective sense of how tricky the email looks.
How often should I change phishing simulation difficulty?
Escalate on a monthly cadence within a 90-day cycle rather than jumping tiers instantly. Users need two consecutive clean cycles at one tier before moving up.
What click rate is normal for advanced-tier phishing simulations?
A 10-15% click rate on advanced-tier simulations is typical for a maturing 2026 program. The same rate on a novice-tier campaign signals the program needs remedial attention.
Should executives get harder phishing simulations than staff?
Yes — executives and finance staff are higher-value targets for real attackers, so advanced and expert-tier templates should reach them earlier in the escalation schedule.
Is it better to start every employee at the same difficulty level?
No. Segment by role and phishing history first. A finance employee with two prior clicks needs a different starting tier than an IT admin with a clean record.
How do MSPs manage difficulty tiers across multiple subclients?
A multi-tenant platform with per-client tier visibility avoids the spreadsheet tracking most MSPs fall back on. DefendWise runs this from a single console across every subclient for one flat fee.
What's the biggest mistake in setting phishing simulation difficulty?
Skipping the baseline click-rate step. Without a starting number, a 15% click rate on a new tier looks like a crisis when it might actually be a normal, expected outcome for that difficulty level.
Can phishing simulation difficulty levels satisfy cyber insurance requirements?
Tiered, escalating simulations with documented thresholds give cleaner evidence for 2026 cyber insurance renewals than a single static template repeated quarterly.
One last thing
The click rate that should worry you most isn't the highest one — it's a flat line across every tier for three cycles straight. That means either your templates aren't actually escalating in difficulty, or your users have plateaued and need a segmentation change, not another simulation.