Your First Phishing Campaign: What to Expect (and What's Normal)

You've signed up and imported your employees. Now you're staring at the "Send Campaign" button. Here's what happens when you press it, and what the results mean.

Before you send

Pick a template that matches the email your team gets every day. On Microsoft 365? The "password expiry" template works well. Use DocuSign? Try "document ready for signature". The more realistic the template, the more useful the test.

Send the first campaign to your whole team. You want a baseline that covers everyone, not a partial picture.

What happens when you click send

Emails don't go out all at once. PhishPlease staggers delivery across your chosen time window, the way real phishing campaigns do. Your dashboard shows each email as it lands.

The first 24 hours

Most clicks happen within the first 4 hours. Your dashboard fills with opens and clicks. This is normal. Don't warn people, and don't send a follow-up.

What a first campaign with an untrained team usually looks like:

Most people open the email
Some of them click the link
Only a few report it as phishing

A high click rate doesn't mean your team is bad at security. It means they haven't been trained yet. That's why you run the simulation.

What clickers see

An employee who clicks the link lands on an educational "caught" page. It explains what they missed, points out the red flags in the email and links to training. This is the teaching moment. It beats any webinar because it happens in context.

Reading your results

Your dashboard breaks results down by department, by person and over time. Look for:

Department hotspots. Some departments click more than others. Sales teams click links all day. They're trained to respond fast, and that makes them vulnerable.
Repeat clickers. A few employees will click on every simulation. Give them extra training and attention.
Report rates. This is the number you want to grow. Employees who report suspicious emails are your first line of defense.

What to do next

Run another campaign in 2-3 weeks with a different template, a little harder than the first. Over 3-6 months, click rates drop and report rates rise. That's measurable behavior change, and it's what your insurer wants to see.