Cloud collaboration
Practice checking unexpected workspace, document, calendar, and video invitations through known services and project context.
For Fully Remote Companies
Phishing Simulation Planning for Fully Remote Companies
Fully remote companies depend on cloud identity, chat, video, shared documents, delivery services, and support interactions between people who may never meet in person.
A useful simulation should practice how employees verify those requests from any approved location and device, with reporting and follow-up that work asynchronously.
Remote-work scenarios • Device-aware planning • Trusted reporting • Contextual measurement
01Understand the environment
Design around how fully remote companies actually work
Start with the channels, devices, time zones, identities, and support routes involved in the selected workflow. Remote employees need a verification action they can complete without relying on the suspicious message or walking to a local help desk.
Remote onboarding
Use fictional welcome, equipment, payroll, benefits, and access requests without exploiting the uncertainty of a real new hire.
Distributed finance
Reinforce known callback and approval routes for payments, expenses, subscriptions, and bank-detail changes.
Remote support
Practice contacting the saved provider before installing software, sharing a code, approving a prompt, or granting screen access.
02Choose the scenario
Use a recognizable remote request with a safe response
Give the scenario one learning objective and use fictional colleagues, organizations, projects, files, and incidents. Keep the campaign inside approved workplace channels and supported devices.
Shared project document
Ask employees to validate an invented owner, project, permissions request, and destination before opening the file.
Video-meeting invitation
Practice checking the organizer and expected platform before joining or entering account information.
Equipment delivery notice
Use a fictional shipment to reinforce independent checking instead of opening an unexpected attachment or sign-in page.
Remote IT request
Ask employees to contact the known support route before installing a tool or sharing an authentication code.
03Plan responsibly
Resolve device, timing, and support questions before launch
| Consideration | Question to answer | Required preparation |
|---|---|---|
| Out-of-band verification | Can employees confirm the request without its reply address, link, phone number, or chat account? | Provide a trusted directory, saved contact, known portal, or authenticated internal route. |
| Device scope | Which managed and personal devices, browsers, mail clients, and accessibility tools are approved? | Pilot supported environments without requiring invasive access or unsafe changes on personal devices. |
| Time zones | Will participants receive the exercise when support teams are unavailable? | Use staffed delivery windows or publish an asynchronous reporting route and response expectation. |
| Real incidents | Could the message overlap a cloud outage, compromised account, or active support problem? | Check operational status before launch and document conditions that stop the campaign. |
04Run the exercise
Move from an approved brief to remote follow-up
- 1
Define one behavior
State the request being tested, expected verification or reporting action, authorized audience, supported channels, and intended use of campaign events.
- 2
Confirm the trusted route
Make sure employees can independently reach the authentic service, directory, support contact, reporting tool, or manager from their normal location and device.
- 3
Pilot representative setups
Test supported devices, mail clients, browsers, accessibility tools, time zones, email controls, landing pages, reports, and follow-up material.
- 4
Brief distributed responders
Prepare security, IT, communications, managers, and providers to support the exercise while continuing to treat unrelated reports as real.
- 5
Debrief asynchronously
Provide a prompt explanation employees can access across schedules, offer a question route, and assign each workflow or control improvement to an owner.
Source: NIST Guide to Enterprise Telework, Remote Access, and BYOD Security
05Measure responsibly
Interpret results in remote-work context
Record intended recipients, exclusions, successful deliveries, unique recipient events, verified reports, response handling, and completed follow-up. Reconcile security-tool automation and repeated events before attributing activity to an employee.
Interpret results with time zone, working hours, device, network, platform familiarity, accessibility, language, leave, and support availability in view. A delayed report may reflect asynchronous work rather than employee judgment.
Use the review to improve reporting, identity, remote access, collaboration, device, provider, or support processes. One campaign interaction does not explain why a decision occurred and should not become an employee risk score.
Common questions
Common questions about Phishmake's features, onboarding, and support, answered to help you get started with confidence.
Can a simulation be sent to a personal device?
Only when policy and the approved scope permit it. Do not require invasive access or configuration changes, and collect only the minimum event data needed for the exercise.
How should fully remote employees verify an IT request?
They should use an independently known route such as a saved support portal, authenticated company directory, established internal channel, or approved phone number.
When should a global remote campaign launch?
Use a window with adequate response coverage or stagger equivalent deliveries by region. Provide an asynchronous path for reporting and questions where continuous coverage is unavailable.
Should remote employees be ranked by response speed?
No. Working hours, time zones, leave, notification settings, device access, and support availability affect timing. Use response data to improve workflows, not rank individuals.
Sources & further reading
Published by Phishmake · Updated
Keep building your program
All resourcesPut it into practice
Build practical awareness for fully remote companies.
Explore how Phishmake connects controlled workforce simulations, relevant training, campaign activity, and follow-up reporting in one workflow.