Phishing Simulation: How It Works to Reduce Risk

**Executive Summary:** This document outlines phishing simulations as a controlled method to test and reduce human-driven risk by sending realistic lures, tracking user responses (clicks, replies, credential entry, reporting), and using measurements to guide training and controls; it emphasizes AI-powered simulations for increased realism and variation and recommends integrating simulations with awareness training, email defenses, reporting workflows, and access controls.