Phishing Simulation Effectiveness & Feedback Survey

Welcome! This brief survey (approximately 10 minutes) asks about your experience with recent phishing simulations at this organization. Your responses are completely confidential and will be reported only in aggregate to improve security awareness training. Participation is voluntary, you may stop at any time, and there are no right or wrong answers—we simply want your honest opinions. Thank you for your time.

Have you ever received a phishing simulation email from this employer?

• Yes, at this employer
• Yes, but only at a previous employer
• No, never
• Not sure

Overall, how realistic did the most recent phishing simulation feel?

Before your most recent simulation, how confident were you in your ability to recognize and respond to phishing emails?

Please rank the following training formats from most helpful to least helpful.

1. Interactive phishing simulations
2. Short videos (≤3 minutes)
3. Live workshops or webinars
4. Job aid or one-page checklist
5. Email tips or newsletters
6. Microlearning modules (5–10 minutes)

Based on your responses in this survey, what suggestions do you have for improving future phishing simulations or related security training? Please share any specifics.

On a typical workday, approximately how many emails do you handle?

• 0–24
• 25–74
• 75–149
• 150+
• Prefer not to say

Thank you for participating! Your feedback will directly help us make phishing simulations and security training more relevant and effective.

When was the most recent phishing simulation you recall receiving from this employer?

• Within the last 7 days
• 2–4 weeks ago
• 1–3 months ago
• More than 3 months ago
• I don't recall
• Not applicable—I haven't received one here

Which aspects of the simulation felt realistic? Select all that apply.

• Sender name and email address
• Subject line
• Email body content and tone
• Visual design and branding
• Call-to-action (link or attachment)
• Timing of delivery
• None of the above

Today, how confident are you in your ability to recognize and respond to phishing emails?

How frequently would you prefer to receive phishing simulations?

• Twice per month
• Monthly
• Every 2 months
• Quarterly
• Twice per year
• Once per year

Which of the following best describes your primary job function?

• Engineering/IT
• Operations
• Sales
• Customer Support
• Human Resources
• Finance
• Legal
• Marketing/Communications
• Other
• Prefer not to say

Thinking about your most recent simulation from this employer, what did you do? Select all that apply.

• Reported it using the reporting tool/process
• Deleted it without interacting
• Clicked a link or opened an attachment
• Replied to the message
• Ignored it and took no action
• Asked a colleague or IT for advice
• Marked it as spam/junk
• I don't recall

How difficult was it to identify the most recent simulation as a phishing attempt?

What, if anything, did you learn or reinforce from the simulation(s)? Select all that apply.

• How to use the report button or process
• How to inspect URLs safely
• Common red flags to watch for
• How to verify sender identity
• To pause and validate urgent requests
• Where to find internal guidance/resources
• Nothing new to me

How long have you worked at this organization?

• Less than 6 months
• 6–12 months
• 1–3 years
• 3–5 years
• More than 5 years
• Prefer not to say

Which cues, if any, did you notice in the simulation? Select all that apply.

• Suspicious sender or domain
• Generic greeting or unusual salutation
• Spelling or grammar errors
• Urgent or threatening language
• Unexpected attachment
• Mismatched or odd-looking URL
• Unusual request for sensitive data
• Off-brand visuals or layout
• Timing felt unusual (e.g., outside business hours)
• I did not notice any specific cues

In the next 30 days, how likely are you to change any of your email habits based on these simulations (e.g., reporting suspicious messages faster, inspecting links more carefully)?

In which region are you primarily based?

• Americas
• EMEA
• APAC
• Prefer not to say