How do you run a phishing simulation for Indian employees?
Key takeaways
- A phishing simulation needs written management approval and a safe harbour before a single email is sent, because the exercise otherwise creates a real legal and HR problem, and one approval covers all 4 waves.
- Measure reporting rate, not just click rate: an organisation where employees report a lure to security has the outcome that matters, and one report is worth more than 10 clicks.
- Never collect real passwords on a simulated landing page, because a captured credential is a live credential, and one captured OTP turns a training exercise into a breach with a 6-hour CERT-In clock.
- Typical Indian phishing simulation campaigns cost Rs 25,000 to Rs 1,50,000 for 100 to 500 employees, with per-employee pricing for larger rollouts.
- Keep the simulation traffic and domains separate from production email so that mail filters and reputation systems are not disrupted, because one blacklisted sending domain can stall 3 campaigns.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What makes a phishing simulation lawful and safe in India?
Four safeguards, and the first is not optional. Written approval from the management or the board, naming the campaign, the dates, the departments and the escalation path, so that a triggered customer support call or a panicked HR complaint has a documented answer. A safe harbour for anyone who participates in the exercise, and an explicit exclusion of anyone who does not consent, because in India an employee's agreement to be tested is the thing that keeps the exercise defensible. Then two technical rules: every lure domain is one you own and control, and every landing page is a training page that does not and must not collect real credentials. Collect the email address if you want to know who clicked, but never a password, and never a one-time password. A simulation that captures a live OTP has created an incident, and the CERT-In 6-hour reporting clock starts.
What does the runbook look like, step by step?
Eight steps. One: agree the objectives, which is either measuring baseline susceptibility or training a specific department, and write that down. Two: get written approval and the safe harbour. Three: build the lure set, typically 4 to 6 templates, and the landing pages, one per scenario. Four: pilot with 10 to 20 volunteers, because templates that embarrass people get deleted, and templates that trigger mail filters get blocked. Five: run wave 1 across the organisation, then analyse, then train. Six: run waves 2 and 3 with different scenarios and a harder landing page, which is where behaviour actually changes. Seven: run a targeted follow-up for repeat clickers, which is a training session, not a warning letter. Eight: report to management with the trend, the reporting rate and the specific scenarios that worked, so the next budget request has evidence behind it.
Which scenarios actually work against Indian employees?
The ones that mirror how Indian fraud actually arrives. The fake KYC update from a bank or a fintech, which is one of the most successful lures in India because the request looks routine. The invoice or Statement of Account attachment over WhatsApp or email, which is a well-established delivery route for business email compromise. The parcel or courier fee-on-delivery SMS with a fraudulent link. The HR or payroll update asking for bank details, which works because it is plausible and it is urgent. The fake government or tax notice, and the customer-support impersonation on WhatsApp, which is a major first-entry route in Indian scams. The CEO impersonation asking for a quick transfer, which is the most dangerous one because it is aimed at a small number of people with authority, and those are the employees you should test with a specific scenario rather than a generic one.
What should you measure, and what does it cost?
Four metrics. Click rate, which is the obvious one and the least useful on its own. Reporting rate, the share of employees who report the lure instead of clicking it, which is the number that predicts resilience. Credential submission rate, the share who typed something, which should be zero if your landing pages are built correctly, so any non-zero figure means the control failed. And time to first report, which tells you how long a malicious email sits in inboxes before somebody raises it, and which is the metric that links directly to your incident response. The campaign cost in India is Rs 25,000 to Rs 1,50,000 for 100 to 500 employees, with larger rollouts priced per employee, and a typical package includes 3 to 4 waves, the landing pages, the training content and a management report. The training follow-up is where the money actually returns.
| Wave | Scenario | What you measure | Training follow-up |
|---|---|---|---|
| Wave 1, baseline | Fake KYC or bank update email | Click rate and report rate | Company-wide 20-minute briefing |
| Wave 2, harder | Invoice attachment with a credential lure | Credential submission rate | Targeted session for finance and payroll |
| Wave 3, channel shift | WhatsApp courier or parcel SMS lure | Report rate on a mobile channel | Manager-led reinforcement for field staff |
| Wave 4, high risk | Executive impersonation for a payment | Time to first report | Direct coaching for the finance approver |
What are the frequently asked questions?
Get a straight answer on this
Send us your employee count and the departments you want covered, and we will return a campaign plan, the scenario set and a fixed price band.
Send us the details See pricing