Spearphishing Simulation Governance

Protect Your Organization with Ethical Phishing Simulations

Running a spearphishing simulation is a high-stakes task that requires rigorous governance, legal alignment, and clear communication. This skill provides a structured framework for security professionals to plan, govern, and report on authorized defensive simulations without the risk of creating actual harmful content.

What it does

This skill acts as a specialized governance layer for your security awareness program. It guides you through:

• Planning: Defining objectives, target populations, and exclusion rules for a safe test environment.
• Governance: Generating stakeholder approval packs for HR, Legal, and Executive teams.
• Execution Readiness: Validating that message themes are effective but safe (no credential harvesting).
• Analysis & Reporting: Transforming raw data from your simulation platform into professional After-Action Reports (AAR) and remediation trackers.

Why use this skill?

Prompting an AI yourself often leads to safety filters blocking your requests or, conversely, generating "too-realistic" content that violates corporate policy. This skill ensures your simulated campaigns remain purely for training purposes. It follows strict quality gates to ensure all activities are documented, authorized, and mapped to defensive controls, saving you hours of document preparation while maintaining a high compliance bar.

Output

The skill produces structured governance artifacts, including Campaign Briefs, Readiness Checklists, and Metrics Analyses, formatted specifically for internal security audits and stakeholder review.