How to run internal phishing simulations for your organization (free & self-hosted)

How to run internal phishing simulations for your organization (free & self-hosted)

Phishing is still how most breaches start. The single most effective defence isn't
another mail filter — it's people who can spot a lure and report it. The way you build
that instinct is internal phishing simulations: controlled, authorized fake-phishing
tests of your own employees, paired with training the moment someone slips.

This is a practical guide to doing that well — and doing it for free, on your own
infrastructure, with an open-source tool.

First rule: authorization, always

Internal phishing simulation means testing people who have agreed to be tested — your
own organization, or a client with a signed engagement scope. Point a phishing tool at
anyone outside that and you're very likely breaking the law. Keep a record of your
authorization, tell leadership and (per your policy/works-council rules) employees that a
program exists, and never use captured data for anything but the training exercise. Good
tools are built as trainers, not credential-harvesters — for example, they don't store
the passwords people type into a fake login page by default.

With that ground rule set, here's what a real program looks like.

A good program is a loop, not a single test

"Who clicked?" is where most free tools stop. A program that actually reduces risk runs
four stages:

1. Attack — send a believable lure and track engagement per person.
2. Report — make it one click for employees to report suspicious mail, and give them credit when they do.
3. Train — the moment someone clicks or submits, teach them what they missed.
4. Measure — roll it all up into a human-risk score you can trend over time.

You can assemble this from separate tools, or use one platform. Below I'll use
VoltPhish, an open-source, self-hosted
platform that does the whole loop from one Docker container. (If you only need email
click-tracking, GoPhish is the classic minimal option;
commercial suites like KnowBe4 or Proofpoint do all of this too, but they're per-seat and
your data lives in their cloud.)

Step by step

1. Self-host it

Because it's self-hosted, employee data never leaves your infrastructure:

docker run -d --name voltphish -p 9990:9999 \
  -e VOLTPHISH_SECRET_KEY="$(openssl rand -base64 48)" \
  -v voltphish-data:/data \
  baymaxarmed/voltphish:latest

Open http://localhost:9990, sign in with admin / admin, and set your own password.

Tip: before touching real inboxes, set VOLTPHISH_MAIL_BACKEND=console to do a
dry-run — every "sent" email is written to a file instead of mailed, so you can rehearse
the entire open → click → submit → train flow with zero real email.

2. Build your audience

Import your employee list into a group (name, email, department). Flag execs and finance
as VIPs — they're the most-targeted, so their results matter more.

3. Pick a lure

Start from a template gallery (Microsoft 365 password expiry, HR/payroll, courier,
MFA re-enrollment, a QR "quishing" code, a calendar invite…) or describe a scenario and
have AI draft one. Match the difficulty to your audience; don't start on "impossible."

4. Launch and track

Add your SMTP details as a sending profile, then launch — only against your authorized
list. You'll see, in real time and per person: delivered → opened → clicked → submitted →
reported.

5. Close the loop automatically

This is the part that changes behaviour:

• Just-in-time training: anyone who clicks lands on a short page showing the red flags they missed.
• Adaptive auto-enrollment: people who fail are automatically enrolled in a training module matched to the attack type.
• Report-Phish button: deploy a one-click Outlook add-in / Gmail script so employees can report suspicious mail. Reported simulations credit them as "Security Champions"; reported real threats land in a triage queue for your security team.

6. Measure human risk

Instead of a one-off click rate, track a behaviour-based human-risk score per person
and per department, a most-targeted/VIP view, a geo map of where clicks came from, and
your click/report rates against a public baseline (e.g. the Verizon DBIR). Run a campaign
every few weeks and watch the number trend down.

Metrics that actually matter

• Report rate (going up) is a better health signal than click rate (going down) — it means people are actively defending, not just avoiding.
• Repeat clickers — a small group usually drives most of the risk; target them.
• Time-to-report — how fast your fastest reporter flags a live threat.

Wrapping up

Internal phishing simulations only work when they're a program: authorized, continuous,
and paired with training and reporting — not a one-time "gotcha." You don't need an
enterprise budget to run one. A free, self-hosted, open-source tool gives you the full
loop while keeping employee data on your own infrastructure.

If you want to try the setup above, VoltPhish is on GitHub (AGPL-3.0):
https://github.com/Baymax-armed/Voltphish — one docker run and you're testing in
minutes. Whatever tool you choose, get authorization first, start easy, train at the
teachable moment, and measure human risk over time.