A phishing simulation has one job: give people a safe opportunity to practise before the real attack arrives. For Human Defense Month 2026, we prepared four phishing simulation templates for CYBERDISE operators, from realistic everyday business situations to something considerably more ridiculous. Use one or use them all and adapt them to your organisation.
1. ClickFix: Shared Document + Fake CAPTCHA
A colleague shares a document. You open it. Before you can continue, a CAPTCHA-style security check appears. Except this time, the “verification” is the attack. Looks familiar enough, right? Because a similar scenario was part of the Berlin hack 2026.
Our ClickFix exercise recreates the increasingly common technique of using fake verification or troubleshooting instructions to persuade users to perform actions they normally would not perform.
2. Google Workspace: Mandatory Two-Step Verification
“Two-step verification is now required for your account.”
Nothing particularly suspicious about that sentence — which is exactly the point.
The exercise uses a familiar Google Workspace security notification and login flow to practise what happens when a perfectly plausible security message asks you to sign in.
3. Jira: Confirm Your Account Permissions
A Jira notification tells you that somebody assigned a work item to you and asks you to review your account permissions.
Normal workday stuff.
This template deliberately sits close to an everyday business process: familiar brand, familiar task, familiar login.
4. The Royal Inheritance Scam
And then there is this one: We have a message from the Royal Kingdom of Zuvania! A royal prince. A confidential inheritance. A very substantial amount of money waiting to be released.
Subtle? Not particularly.
Useful? Absolutely.
Because not every security exercise has to pretend to be deadly serious. Sometimes an exaggerated example starts a better conversation than another perfectly crafted password-reset email. What CISO wouldn’t want to know the reporting rate for a scenario like this? Or are there actually employees who fall for something like this?! If so, that’s definitely a great story to share! And that’s what it’s all about!
Practice and involve
Just to be clear: these exercises aren’t about catching employees making mistakes. They’re about recognising issues, staying alert and maintaining engagement. This can also be achieved with content that includes a touch of humour.
The main goal is not about knowing, it is about recognising, verifying, reporting, then talking about what happened (involvement and engagement). That is the Human Defense Month idea in miniature:
Awareness is useful. Practice is better. Knowledge is useful. Behavior is better.
The four phishing simulation templates are part of the Human Defense Month 2026 Community Kit and are designed for use with CYBERDISE.
Import them, modify them and make them yours with a commercial licence or the CYBERDISE Community Edition, and perhaps run one each week during Cybersecurity Awareness Month.
Learn more about phishing simulations with CYBERDISE.
Business is serious enough, let’s have some fun together this month. :-)
So long, Palo
