Last materially reviewed: September 22, 2026
Direct Answer
A phishing simulation for a Philippine business is a controlled employee-awareness exercise that tests whether employees recognize and report suspicious messages. Treat it as training and measurement—not humiliation or covert disciplinary surveillance. Before launch, approve a short exercise charter covering: the business objective; employees and executives in scope; authorized sender domains and technical safeguards; scenario types and prohibited themes; test dates or windows; the data to be collected; retention and access limits; the reporting channel; immediate coaching; escalation for an actual security incident discovered during the test; success metrics; exceptions; and the owners from security, privacy, HR and management. Use realistic but proportionate scenarios, minimize employee-data collection and never request or store real passwords.
Key Takeaways
- Measure reporting, not just clicks.
- Avoid deceptive scenarios involving highly sensitive personal issues unless clearly justified and approved.
- Do not request real employee passwords.
- Provide immediate education after the exercise.
- Use results to improve processes, not to shame individuals.
Set the objective first
For a Philippine business, set a phishing simulation objective by testing one or two observable employee behaviors: link checking, attachment handling, reporting, credential-page recognition or payment verification. CyberCode’s guide advises keeping the scope narrow because a simulation with too many variables is harder to interpret.
Design realistic scenarios
Safe phishing simulation scenarios for Philippine employees should follow clear design limits: use only approved infrastructure; mirror situations employees actually encounter, such as shared documents, delivery notices, password resets, invoice requests or internal collaboration messages; make the difficulty proportionate to the audience; include recognizable warning signs; prevent delivery outside the approved group; use simulated attachments and login pages that cannot collect real credentials; provide a safe reporting route; and prepare an immediate teaching page. Avoid themes involving dismissal, salary loss, medical diagnoses, bereavement, disasters, criminal accusations or other highly sensitive events unless a documented, proportionate need and senior approval exist. Do not impersonate a real bank, regulator, customer or executive in a way that could cause an actual payment, disclosure or external complaint.
Protect employee data
A Philippine business should collect only the personal data necessary to measure the approved exercise, such as delivery, reporting, click and simulated-field events. Do not collect real passwords, one-time PINs, answers to security questions, private email content, personal contact lists, unrelated browsing history, keystrokes, screen recordings, precise location or sensitive personal information. Avoid retaining full IP addresses, device identifiers or individual-level results when aggregated data will answer the training question. Apply the Data Privacy Act principles of transparency, legitimate purpose, proportionality, security and limited retention; restrict access to authorized personnel and tell employees how simulation data will be used.
Useful metrics
- Reporting rate: percentage of recipients who used the approved reporting channel
- Median time to report: how quickly the first and typical reports reach the security team
- Click rate: useful as a learning indicator, but not a stand-alone employee score
- Simulated credential-entry attempt rate: record the attempt only; never collect the entered password, OTP or security answer
- Improvement after coaching: compare later reporting and interaction trends without creating a permanent shame list
- Control and department trends: identify risky workflows, delivery failures, reporting-channel gaps and role-specific training needs; use aggregation where practical
What to do after the simulation
After an employee clicks a phishing simulation link, the company should: (1) stop the simulation flow before any real credential or sensitive data can be entered; (2) display a short, non-shaming explanation that this was an authorized exercise; (3) identify the warning signs in the message; (4) show the exact reporting channel and what to do after clicking a real phish; (5) offer brief role-appropriate coaching; (6) record only the approved event data; (7) check whether the click exposed a real weakness, such as an unsafe workflow or missing email control; and (8) route repeated difficulty to supportive training rather than automatic punishment. If the employee reports a real suspicious message during the exercise, separate and escalate it as an actual incident.
Do not turn simulations into punishment traps
Fear can reduce reporting and encourage employees to hide mistakes. The goal is a workforce that reports suspicious events quickly, including after a click. State in the charter that ordinary simulation results are for training and control improvement, limit access to individual results, use aggregate reporting where practical, distinguish deliberate policy violations from an honest mistake, and give employees a fair chance to learn. Do not publish names, use surprise tests to embarrass teams, tie one click automatically to discipline, or create incentives that discourage reporting. Any employment action should follow a separate, fair HR process based on an existing policy—not the simulation dashboard alone.
FAQs
How often should phishing simulations run?
There is no single Philippine legal interval for every employer. A practical baseline is quarterly or several varied exercises each year, with additional role-based tests after onboarding, material control changes or credible threat patterns. High-risk teams handling payments, credentials or sensitive data may need more frequent exercises; low-risk teams may need fewer. Avoid constant testing that creates fatigue, and use trend data to adjust frequency.
Should executives be included?
Yes. Executives, owners and senior approvers are high-value targets and should be included rather than exempted. Use role-relevant scenarios involving payment changes, confidential documents, messaging apps, account resets or urgent approvals. Apply the same privacy and non-shaming safeguards, while testing the stronger verification procedures expected for high-risk transactions.
Can a simulation use a fake login page?
Yes, if the page is controlled, approved and technically unable to retain real credentials. Use clearly isolated simulation infrastructure, accept only dummy or non-recoverable test input, stop the flow immediately, and never forward entries to a real identity provider. Do not log passwords, one-time PINs or security answers. The safer default is to record only that the employee reached or attempted to use the simulated page.
Related Cybercode Guides
Official Sources
Primary legal authority and Philippine operational examples used in this guide:
- BPI — warning on executive phishing and employee reporting
- PwC Philippines — phishing indicators and practical cyber hygiene
- NPC DPA Implementing Rules and Regulations
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.