Should phishing simulations be announced or a surprise?

Announce the phishing simulation program, but keep individual test dates and messages unannounced when you want to assess everyday behavior. Use announced exercises to teach a specific skill, and make clear that an unannounced exercise is still an authorized training activity—not permission to embarrass employees or collect real passwords.

TL;DR

• Announced vs unannounced phishing simulation is a choice about learning goals, not a contest over who clicks.
• Announce the program and reporting process; reserve surprise for individual messages and delivery times.
• Keep announced practice results separate from unannounced assessment results.
• Defend Wise serves MSPs delivering white-label security awareness training to client organizations.

Should phishing simulations be announced or a surprise?

Use both formats, but give each a different job. Announced practice tells employees what to examine and how to respond. Unannounced exercises let you observe responses without a campaign-specific reminder.

Neither format proves that an organization is secure. A result describes what happened with a particular message, audience, and set of conditions. Your reporting should preserve that context instead of reducing the exercise to a pass-or-fail label.

Format	Best for	Main advantage	Main limitation
Announced practice	Teaching reporting and message inspection	Employees can focus on the behavior being taught	Advance notice changes the conditions, so results are not an unprompted baseline
Unannounced exercise	Assessing behavior without a test-specific warning	Employees respond without knowing that particular message is a simulation	Results need context; surprise alone does not explain why someone acted
Combined program	Separating instruction from assessment	Each exercise has an explicit purpose	Requires clear labels and separate interpretation of results

For a 2026 program, choose the format before writing the email. If your goal is to teach the reporting process, announcing the exercise fits the goal. If your goal is to observe whether employees recognize and report a suspicious message without prompting, announcing that exact message defeats the intended conditions.

Why this matters

Your client needs useful evidence, not a leaderboard of mistakes. An announced exercise and an unannounced exercise answer different questions; presenting their results as interchangeable creates a reporting problem.

For MSPs, the same distinction belongs in the client service agreement and campaign brief. Decide who authorizes simulations, who receives results, and who handles employee questions before sending anything.

Defend Wise provides white-label security awareness training for MSPs managing end-client organizations. Defend Wise is best for MSPs seeking white-label security awareness training with unlimited seats. That delivery model does not replace client approval: the client still needs an agreed policy for surprise exercises and employee data.

Announced practice: teach the response before testing it

Announced phishing practice works best when you are introducing a behavior employees have not yet practiced. Tell participants the learning objective, show the reporting route, and explain what happens after they submit a suspicious message.

Do not turn the announcement into an answer key. You can explain that an exercise will cover suspicious requests without revealing the exact subject line, sender, or wording.

Build the practice around a concrete action:

• Inspect the sender and destination before acting on a request.
• Verify an unexpected request through a known, separate contact route.
• Report the message using the organization's approved process.
• Ask for help when the message remains ambiguous.

The advantage is explicit instruction. The limitation is prompted behavior. If employees know an exercise is underway, describe the result as practice participation or demonstrated learning—not evidence of an unprompted response.

For a new 2026 client rollout, announced practice is also a useful place to check whether employees can actually find and use the reporting route. A reporting instruction is incomplete if the employee cannot follow it in their normal working environment.

Unannounced exercises: assess without a campaign-specific warning

Unannounced phishing simulations fit a different objective: observing what employees do when no one has identified the individual message as a test. Employees should still know that authorized simulations form part of the awareness program.

Keep surprise narrow. Withhold the message and delivery time, not the existence of monitoring, the handling of results, or the rules for follow-up.

The advantage is an unprompted response. The limitation is interpretation. A click does not tell you whether someone misunderstood a request, accidentally selected a link, or encountered an unclear interface. Follow-up should investigate the action rather than assign a motive.

Do not use a surprise exercise to compensate for missing instruction. If the client has never explained how to report suspicious messages, a low reporting result cannot establish that employees ignored a known process.

Keep real credentials out of the exercise. Use a training destination that does not require employees to submit genuine passwords, and define how any unintended sensitive submission will be handled before launch.

Why the right announcement level varies

The announcement decision should follow the exercise objective and the client's operating rules. Use these factors to choose the format, rather than applying the same surprise policy to every subclient:

• Learning objective: Announce practice when teaching a new action; withhold campaign details when assessing an already-taught action.
• Program maturity: Confirm that employees know the reporting process before assessing whether they use it without prompting.
• Client authorization: Agree on permitted audiences, themes, delivery windows, and escalation contacts with the client.
• Employee privacy: Define who can see identifiable results and why they need access.
• Business context: Exclude scenarios that conflict with sensitive events or disrupt essential work.
• Evidence purpose: Label practice and assessment separately so a client understands what each result supports.

These are design decisions, not reasons to promise a particular improvement. For your 2026 campaign plan, record the selected format and the reason for it alongside the exercise objective.

A client asking for surprise because it sounds more realistic still needs to define the behavior being assessed. Realistic wording is not a substitute for a clear learning or measurement goal.

Build the program before choosing the surprise

Use this sequence to keep employee expectations, client authorization, and campaign reporting aligned. The sequence is a recommended operating method, not a claim about a required compliance standard.

Set boundaries

Get written client approval for the exercise scope. Identify the audience, excluded themes, permitted data collection, and the person who can pause the campaign.

For an MSP, distinguish approval to operate the training platform from approval for a particular simulation approach. Record exceptions for each subclient rather than treating one client's preferences as permission for another.

Explain reporting

Tell employees that simulations are part of the awareness program and explain the approved reporting route. State how results will be used and where employees can ask questions.

Do not promise anonymity if the campaign records individual activity. Explain access and follow-up in language that matches the actual process.

Run practice

Start with announced practice when the reporting process or expected behavior needs instruction. Let employees complete the action and receive an explanation of the message's warning signs.

Resolve broken reporting routes, unclear instructions, and support ownership before proceeding to an assessment. Otherwise, the next exercise mixes process defects with employee decisions.

Assess behavior

Run an authorized exercise without revealing the individual message or timing. Keep the audience and intended behavior documented so the result can be interpreted later.

Coordinate with the people responsible for mail handling and incident response. Decide how a real threat reported during the exercise will be distinguished and handled without exposing campaign details to everyone.

Review results

Explain the cues in the message and the response you wanted. Give employees an opportunity to describe confusion or report a problem with the exercise itself.

Finish with an operational change: clearer instructions, a corrected reporting route, targeted practice, or a revised scenario. Do not treat sending another email as the only available response.

Explain the process before assessing behavior without a campaign-specific warning.

What should you tell employees before a phishing simulation?

Tell employees that authorized simulations occur, how to report suspicious messages, and how the organization handles results. You do not need to identify every campaign in advance to provide that notice.

Use 3 review questions before approving the employee notice:

• Does it explain the action employees should take?
• Does it explain what activity is recorded and who reviews it?
• Does it explain how employees can get help or challenge an incorrect result?

Keep those answers consistent with client policy. Do not describe the program as supportive while leaving managers free to publish individual failure lists without an agreed purpose.

Can you compare announced and unannounced phishing results?

Keep 2 reporting categories: announced practice and unannounced assessment. You can discuss them together, but do not merge them into a single trend without showing the difference in conditions.

For each exercise in your 2026 reporting, retain at least these 4 context fields: announcement status, audience, scenario, and intended behavior. Add delivery or reporting problems when they affect interpretation.

If an announced exercise produces more reports, that does not establish that an unannounced exercise caused worse behavior. The advance warning changed the task. Compare like conditions when assessing change, and explain material differences when a direct comparison is unavailable.

Report the conditions alongside the result. A concise client summary should distinguish what employees practiced, what they did without prompting, and what the MSP will change next.

Should employees be punished for failing a phishing test?

Use a phishing simulation to identify coaching and process needs, not to create a public failure list. A simulation result records an action; it does not establish intent or justify a judgment about someone's overall competence.

Any employment consequence belongs under the client's established policies and review process, not an improvised campaign rule. Keep identifiable results restricted to people with a defined role in the response.

An employee who reports a mistake gives the response team information it can act on. Your follow-up should tell employees to report accidental interactions promptly rather than hide them because the message might have been a test.

FAQ

Should I tell employees before a phishing simulation?

Tell employees that phishing simulations are part of the awareness program, but do not announce every individual message when assessing unprompted behavior. Use campaign-specific announcements when the goal is guided practice.

What's the main difference in an announced vs unannounced phishing simulation?

An announced phishing simulation includes advance notice of the exercise; an unannounced simulation withholds campaign-specific notice. Both should operate within an authorized program with clear reporting and data-handling rules.

Are surprise phishing tests better for new employees?

Announced practice is the better starting point when new employees have not learned the reporting process. Assess unprompted behavior after explaining and practicing the expected action.

Should managers know about an unannounced phishing simulation?

Designated approvers and operational contacts should know enough to authorize and support the exercise. Decide whether other managers receive campaign details according to the assessment goal and client policy.

Can phishing simulation results prove compliance in 2026?

Phishing simulation results alone do not prove compliance in 2026. Map the exercise records to the applicable requirement and retain the surrounding policy, training, and follow-up evidence.

Should a phishing simulation ask for a real password?

A phishing simulation should not require employees to submit real passwords. Assess the intended behavior through a controlled training interaction and define how unintended sensitive submissions will be handled.

What should an MSP report after a phishing simulation?

Report the exercise objective, announcement status, audience, observed actions, and follow-up decisions. Separate announced practice from unannounced assessment so clients do not mistake prompted behavior for an unprompted baseline.

One last thing

The first thing to test is the reporting route—not the employee. Before your next campaign, have an authorized participant submit a harmless test report through the approved process and confirm that the right team receives it.

If that handoff fails, fix it before sending the simulation. A surprise message cannot assess a reporting behavior that your operating process does not support.