How to Run Phishing Simulations for MSP Clients

To run phishing simulations for MSP clients, get each client's leadership to sign a no-blame rule and decide who sees results. Tell employees simulations are part of the program. Safelist your sending infrastructure and sync the directory per tenant. Give every client one report button. Stagger sends by person, keep clicker feedback short and private, and report monthly with the reporting rate first.

Most buyer's guides help you pick a tool. This one is about running it across 30 tenants on a Tuesday.

1. Get the no-blame rule in writing before the first send

Before any email goes out, sit down with the client's owner or leadership and agree on two things in writing. First, nobody gets disciplined for clicking a simulation. Second, a named short list of people can see individual results. Everyone else sees team or company numbers.

This step saves accounts. The first time a client exec asks for "the list of who clicked" so they can name names in a staff meeting, you want a signed page to point to. Brian Krebs asked the blunt version of this question back in 2019: should failing a phish be a fireable offense?

The research backs the rule. Tolsdorf et al. (2025) found some hospital staff reacted to simulations with fear, shame, guilt, and hostility. People who feel punished are less likely to report. Reporting is the thing you most need.

2. Tell employees simulations are part of the program

A lot of advice says keep simulations secret so you get a "true" baseline. We disagree. At Hook we tell employees up front that simulations are part of the program.

It doesn't ruin the measurement, because you aren't measuring surprise. You're measuring habits: does this person pause, and do they report? Knowing simulations exist doesn't tell anyone which email in their inbox is one. A short note from the client's leader works fine: "We run practice phishing emails. If something looks off, hit the report button. Nobody gets in trouble for clicking."

3. Set up each tenant properly

This is where most MSP rollouts break, and it's all plumbing.

• Safelist your simulation sending domains and IPs in every client's mail filter, whether that's Microsoft 365, Google Workspace, or a third-party gateway.
• Authorize each client's recipient domains, including secondary and acquired domains people forget.
• Connect the directory (Entra ID, Google Workspace, or Okta) so joiners get enrolled and leavers drop off without a CSV.

Send one simulation to a tech or the client contact first. Confirm it lands in the inbox, not quarantine, before the real program starts.

4. One report button per client

Pick one way to report and use it everywhere in that tenant. An add-in button or a forward-to address. If half the office forwards to the help desk and half uses a button, your reporting numbers are fiction.

5. Cadence and difficulty

Start easy. Rozema & Davis (WWW '26, 12,511 employees) found difficulty predicted clicks: 7% on easy simulations versus 15% on hard ones. A brutal first month mostly measures how hard you made the email.

Send monthly and vary what each person gets. Vance et al. (2018) showed attention to repeated warnings drops, and varied designs reduce habituation.

Never send the same simulation to everyone at the same minute. You'll get a help desk flood, and the first person to spot it will warn the whole office on Teams. Spread sends across days and hours.

6. What clickers see

Keep it short, private, and kind. A friendly page explaining the one clue they missed, and a link to report next time. No shaming, no 20-minute module.

Lain et al. (IEEE S&P 2022, 14,000+ employees over 15 months) found embedded training after a click did not improve resilience and could make people more susceptible. Lain's 2024 follow-up suggests the benefit comes from the periodic nudge. So treat the clicker page as a reminder. Skip the punishment course.

7. Report monthly, and lead the QBR with reporting

Send each client a one-page monthly report. Put SERR, the Suspicious Email Reporting Rate, at the top, click rate second. Lain 2022 found employee reporting worked as a fast, sustainable detection system. In Rozema's data, a report arrived before the first click in 36-55% of simulations. That's the number a client owner should care about: did my people warn us in time?

At the quarterly review, open with reporting trend, then clicks, then what's next. Our 15-minute QBR template lays it out.

What goes wrong at 30+ tenants

Small mistakes multiply. The ones we see most:

• A client changes mail filters or adds a gateway, and simulations quietly land in quarantine for two months. Your report shows a great month. It's actually zero delivery.
• New hires never got synced because the directory connection broke or was never set up. The people who know least about what normal email looks like there get nothing.
• A client exec spots a simulation and forwards it to all staff with "DON'T CLICK THIS." That month's data for that tenant is useless. Mark it, don't report it, and thank them for reporting. The instinct was right.

Check delivery per tenant every month. A sudden drop to zero clicks and zero reports is a delivery problem, not a win.

Where Microsoft Attack Simulation Training fits

If a client already has Microsoft 365 E5 or Defender for Office 365 Plan 2, they have Attack Simulation Training included. For one well-licensed tenant with an in-house admin, it can be enough. For an MSP, the friction is that it's managed tenant by tenant, and most SMB clients aren't on those licenses.

How Hook handles this

Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. You manage every client from one multi-tenant console, and Autopilot runs training and simulations automatically each month, with reporting rate as the headline metric. Hundreds of MSPs use it to run programs like this without a spreadsheet. See it in a demo.

FAQ

How often should an MSP send phishing simulations to clients?

Monthly works for most clients, and quarterly is the floor. Reinheimer et al. (2020) found awareness gains faded by six months, so annual or twice-a-year sends leave people at baseline for months.

Should employees be told about phishing simulations in advance?

Yes. You're measuring whether people pause and report, not whether they can be surprised. Telling them builds the trust that makes reporting go up.

Do I need to whitelist phishing simulation emails in Microsoft 365?

Yes, in every tenant and every third-party filter in front of it. Then confirm delivery with a single send to a tech before going live.

What should an MSP show clients in a monthly phishing report?

Lead with the reporting rate and its trend, then click rate, then delivery status. Never list individual names outside the short list the client agreed to in writing.