K-12 faculty and staff
Account for shared devices, substitute and seasonal staff, parent communications, learning platforms, district-managed services, and limited time away from student-facing responsibilities.
Education Security Awareness
Phishing Simulation Planning for Schools and Universities
Education organizations depend on email, learning platforms, cloud documents, payroll systems, student-information services, research tools, and third-party vendors. Each creates legitimate messages that an impersonator may try to imitate.
This guide helps K-12 districts, colleges, and universities design authorized employee simulations around real verification and reporting decisions—without using student records, disrupting instruction, or turning one interaction into a judgment about an employee.
K-12 and higher education • Role-specific scenarios • Privacy boundaries • Actionable reporting
01Start with context
Map the education environment before choosing a scenario
The same email can carry different meaning for a classroom teacher, bursar, researcher, help-desk analyst, or adjunct instructor. Start with the work being performed and the safe action available to that person.
College and university staff
Distinguish central administration from distributed schools, departments, campuses, auxiliaries, and support teams that may use different approval and reporting routes.
Faculty and researchers
Consider collaboration invitations, conference correspondence, grants, shared datasets, publisher messages, and external identities without reproducing real research or participant information.
Privileged and financial roles
Give IT administrators, payroll, procurement, advancement, and financial-aid teams scenarios that reinforce their actual identity, payment, and escalation controls.
02Set boundaries
Separate workforce awareness from student participation
An employee awareness program can include faculty, administrators, finance teams, IT staff, admissions personnel, support workers, and other authorized workforce groups. Record who approved the exercise, who is included, who is excluded, what events will be collected, who can see individual results, and when those records will be deleted or aggregated.
Do not automatically include students in an employee campaign. An exercise involving students—especially minors—needs a separate educational purpose and review of age, consent, safeguarding, accessibility, communications, data handling, and applicable institutional policy. The same separation applies when a message could involve research participants, clinical services, counseling, or other protected relationships.
Tell the teams that may receive reports, including the help desk, security operations, communications, campus safety, and third-party service providers. They should be able to recognize the authorized exercise without dismissing an unrelated real incident.
Source: U.S. Department of Education: Data Security for K-12 and Higher Education
03Choose the decision
Use education scenarios with a clear, teachable response
| Scenario | Decision to practice | Safety boundary |
|---|---|---|
| Learning-platform notice | Open the known learning service independently and inspect the notification there rather than signing in through an unexpected link. | Use a fictional course and notice. Do not reproduce a real class roster, assignment, grade, or student message. |
| Shared cloud document | Check the sender, sharing context, and destination; report an unexpected invitation through the approved channel. | Use an invented document and owner. Avoid active safeguarding, disciplinary, research, or personnel matters. |
| Payroll or benefits update | Reach the authentic HR service from a bookmark or known portal and verify unusual changes with HR. | Do not imitate an active pay issue, employment action, or benefits deadline that could cause distress. |
| Invoice or bank-detail change | Follow the institution's independent callback and approval process before accepting a financial change. | Use a fictional vendor and transaction; never interfere with a real payment, refund, grant, or student-aid process. |
| Account or storage warning | Contact the known IT route or visit the normal identity service rather than trusting an urgent sign-in prompt. | Avoid implying that teaching materials, research, or student records will be deleted during an active deadline. |
| Conference or research invitation | Inspect the sender, destination, requested information, and independent evidence that the opportunity is genuine. | Use invented event, publication, grant, and collaborator details; do not expose unpublished work or participant data. |
04Choose the window
Plan around teaching, enrollment, finance, and emergency operations
The calendar changes both employee context and the institution's ability to respond. Avoid launching during examinations, admissions decisions, enrollment, financial-aid disbursement, payroll deadlines, major research submissions, incident recovery, or other periods when the scenario could be confused with a consequential real message.
For distributed or multi-campus institutions, check local calendars, time zones, holidays, shift patterns, accessibility needs, and support coverage. Include a documented stop condition for unexpected distress, operational disruption, incorrect recipients, broken teaching pages, or unexplained event activity.
Support capacity
Identify who will answer employee questions, receive reports, investigate possible real threats, and stop the campaign. Do not launch when those people are unavailable.
Communication readiness
Prepare the debrief and manager guidance before launch. Decide when participants will be told, what was observed, and where they can ask questions or raise concerns.
Technical readiness
Pilot representative mail clients, browsers, mobile devices, security filters, accessibility tools, links, landing pages, and event records.
Data readiness
Document the minimum campaign data needed, access restrictions, retention period, aggregation rules, and correction process before collecting employee events.
05Run the exercise
Use a six-step workflow from approval to improvement
- 1
Write the campaign brief
State the learning objective, authorized audience, scenario, expected action, data collected, owners, delivery window, exclusions, and stop conditions.
- 2
Confirm the real process
Verify that employees have a known way to check the request and report it. Fix missing phone numbers, portals, reporting buttons, or ownership before testing the behavior.
- 3
Pilot end to end
Send to approved test accounts, exercise every intended action, reconcile deliberate actions with recorded events, and check for automated link inspection.
- 4
Brief responders
Give the help desk, security team, communications owner, and relevant provider enough information to support the exercise while continuing to treat other reports seriously.
- 5
Launch and monitor
Watch delivery, employee support, reporting channels, and operational impact. Stop when a predefined condition is met rather than improvising during a problem.
- 6
Debrief and assign an owner
Explain the message cues and expected action, provide relevant learning, and record each process or control improvement with a responsible owner and review date.
Source: CISA StopRansomware Guide
06Measure responsibly
Report what happened without reducing people to a click rate
Use unique recipients and explicit denominators. Keep event observations separate from explanations, and preserve the conditions needed to compare future exercises fairly.
| Measure | What to record | How to interpret it |
|---|---|---|
| Delivery | Intended recipients, exclusions, deliveries, bounces, and materially altered messages. | An employee cannot respond to a message that did not reach the expected inbox in a usable form. |
| Unique interactions | Unique recipients with the approved event type, kept separate from repeated raw events. | Validate likely security-scanner activity before treating an event as an employee action. |
| Verified reports | Unique reports reconciled across the channels included in the measurement scope. | A report tests both employee behavior and whether the institution's response process is usable. |
| Response quality | Whether reports reached the right owner, received an appropriate response, and exposed routing gaps. | A reporting button alone is not useful if no team owns or reviews the resulting queue. |
| Follow-up | Training assignments, completions, policy clarifications, workflow fixes, and control changes. | Completion records show that an activity occurred; they do not by themselves prove safer future behavior. |
07Beyond awareness
Connect employee practice to the wider cybersecurity program
The U.S. Department of Education identifies phishing and outdated software among the weaknesses that threat actors exploit in K-12 environments. CISA's K-12 guidance emphasizes prioritization and broader risk reduction. A simulation can exercise a reporting and verification decision, but it cannot substitute for identity protection, patching, secure configuration, email defenses, backups, access controls, incident response, vendor management, or recovery planning.
Use the post-campaign review to identify the next responsible action. That may be clearer payroll verification, a better reporting route, phishing-resistant authentication for an exposed service, removal of an unnecessary privilege, a vendor escalation update, or a tabletop exercise for the teams that handle reports.
Higher-education institutions should also review current Federal Student Aid cybersecurity guidance when applicable to their programs and systems. Product usage alone does not establish compliance with education, privacy, financial-aid, or contractual requirements.
Source: CISA: Protecting Our Future—Partnering to Safeguard K-12 Organizations
Common questions
Common questions about Phishmake's features, onboarding, and support, answered to help you get started with confidence.
Should K-12 students be included in phishing simulations?
Do not treat students as an automatic extension of an employee campaign. Establish a legitimate educational purpose and complete the district's review of age, consent, safeguarding, accessibility, communications, data handling, and applicable policy. An employee-focused platform configuration does not make a student exercise appropriate.
Can universities include students in the same campaign as employees?
Employees and students can have different relationships with the institution, acceptable-use rules, support channels, privacy expectations, and learning objectives. Define and review each population separately instead of combining them merely because they use the same email domain.
What data should an education phishing simulation collect?
Collect only the approved event data required for the stated learning and operational purpose. Do not collect real passwords or place real student, family, employee, health, financial-aid, disciplinary, research, or participant information in the message or landing page. Document access, retention, aggregation, and deletion before launch.
When should a school or university schedule a simulation?
Choose a period with adequate technical and employee-support coverage. Avoid examinations, enrollment, admissions decisions, results, financial-aid disbursement, payroll deadlines, major research submissions, emergency communications, and active incident recovery unless there is a specifically approved reason and suitable safeguards.
Should employees who click be publicly identified or ranked?
A single interaction is not a complete measure of an employee's judgment or risk. Review results privately with appropriate access, investigate scenario and process context, provide relevant follow-up, and use aggregate reporting for broader program decisions unless an established policy requires otherwise.
Does phishing simulation training prevent ransomware or establish compliance?
No. Awareness and reporting practice can support a broader cybersecurity program, but they cannot prevent every incident and do not establish legal or regulatory compliance. Institutions also need appropriate identity, email, endpoint, network, backup, access, vendor, response, and recovery controls.
Sources & further reading
Published by Phishmake · Updated
Keep building your program
All resourcesPut it into practice
Build an education awareness program people can use.
Explore how Phishmake connects authorized employee simulations, relevant training, campaign activity, and follow-up reporting in one workflow.