Tips for a Successful Phishing Derby

You’ve seen it before: another company-wide phishing simulation that causes panic, frustration, and a flood of angry emails to your security team. Traditional phishing tests often feel like gotcha moments that leave employees resentful rather than educated. But what if you could transform this dreaded exercise into something your team actually looks forward to?

Enter the Phishing Derby – a gamified approach to security awareness that turns the mundane into engaging, the punitive into rewarding, and the feared into fun.

Why Traditional Phishing Simulations Fail

Let’s face it: standard phishing campaigns often miss the mark. They can:

• Create a culture of fear instead of learning
• Generate resentment when employees feel tricked
• Cause company-wide panic when poorly communicated
• Result in minimal long-term behavior change

As one frustrated IT professional shared on Reddit, “People went into full panic mode thinking the whole company was hacked… then were angry once they found out it was a simulation saying we should’ve warned them.”

Meanwhile, the stakes couldn’t be higher. With an estimated 3.4 billion phishing emails sent daily and 91% of successful cyber-attacks beginning with a phishing attempt, organizations can’t afford to have disengaged employees. A successful attack costs companies an average of $4.91 million – a devastating blow that proper training could prevent.

What Makes a Phishing Derby Different?

A Phishing Derby transforms security awareness from a top-down mandate into a collaborative, skill-building competition. Instead of punishing those who fail, it celebrates those who succeed at spotting and reporting threats.

This approach leverages gamification to create positive engagement, focusing on:

• Voluntary participation rather than forced compliance
• Competitive elements with meaningful rewards
• Public recognition of security champions
• Building a community of cybernuts (security enthusiasts)

Step 1: Planning Your Phishing Derby

Define Clear Goals and Metrics

Before launching, establish what success looks like:

• Baseline metrics: Current click rates, reporting rates
• Target improvements: 20% reduction in clicks, 30% increase in reporting
• Specific focus areas: High-risk departments or specific types of attacks

Get Leadership Buy-In

Nothing derails a security initiative faster than surprised executives. Before launching:

• Brief your CISO and other C-level executives on the concept
• Explain how this supports compliance requirements and SOC 2 audit preparations
• Demonstrate the ROI through projected reduction in successful phishing attempts

Create a Communication Plan

Announce the derby with clarity and enthusiasm:

• Send a company-wide announcement explaining the concept
• Host kick-off meetings to explain rules and demonstrate proper reporting
• Create posters, digital signage, or intranet banners promoting the event

Step 2: Designing an Effective Competition Structure

Set Clear Rules

Based on successful implementations, establish these foundational rules:

• Duration: One month is ideal – long enough to collect meaningful data but short enough to maintain enthusiasm
• Participation: Emphasize that involvement is voluntary and performance won’t negatively impact job evaluations
• Reporting Method: Define a single, clear channel (like using a Phish Alert button in your email client)
• Fair Play: No technical tools or scripts to identify phishes – this tests human detection skills

Create an Enticing Prize Structure

The right incentives drive participation:

• Individual Awards:
  • Top Reporter: $100 gift card for most phishes correctly reported
  • Fastest Finger: Prize for best average response time
  • Eagle Eye: Recognition for catching the most difficult phishes
• Team Awards:
  • Department Champions: Team lunch or outing for highest departmental reporting rate
  • Most Improved: Recognition for departments showing greatest improvement

Craft Realistic Phishing Scenarios

This is where many simulations fall short. To create effective tests:

• Use a proper simulation platform like KnowBe4 or similar services to manage the campaign
• Vary difficulty levels from obvious red flags to sophisticated spear-phishing attempts
• Include current threat intelligence by mimicking real-world attacks targeting your industry
• Customize scenarios relevant to specific departments (finance-focused scams for accounting, etc.)

A well-designed phishing campaign should include emails that test for awareness of:

• Credential harvesting attempts
• Fake password reset notifications (especially for SSO accounts)
• Impersonation of executives or partners
• Invoice or payment scams
• MFA bypass attempts

Step 3: Managing Reports and False Positives

Prepare for the Flood

A successful derby will dramatically increase reporting – both of your simulated phishes and legitimate emails mistakenly flagged as suspicious. This is a good problem to have!

Implement an Efficient Triage System

To handle the increased volume without alert fatigue:

• Establish a dedicated reporting channel – ideally a specialized mailbox or ticketing system
• Automate initial processing – tools like PhishER can automatically categorize simulated phishes vs. real threats
• Consider open-source SOAR platforms like “shuffle” which can automate 80-90% of report handling
• Create templates for common responses to quickly acknowledge and close out false positives

Close the Feedback Loop

Immediate feedback reinforces positive behavior:

• Send automated confirmations for every report (“Thanks for your vigilance!”)
• Provide quick classification (“This was a simulation – great catch!” or “This appears to be legitimate marketing.”)
• Share regular updates on overall derby progress to maintain momentum

Step 4: Measuring Success Beyond Click Rates

Traditional phishing campaigns often fixate on click rates alone, but a comprehensive derby should track multiple dimensions:

Essential Metrics to Track

• Click Rates: Baseline vulnerability (industry average is around 24%)
• Credential Entry Rates: How many users not only clicked but entered sensitive information (industry average is 21%)
• Report Rates: The percentage of simulated phishes that were properly reported
• Time to Report: Average duration between email delivery and employee reporting
• Departmental Variations: Identify high-risk groups needing additional training
• False Positive Rates: Track legitimate emails reported as phishing to refine training

Beyond the Numbers

Quantitative metrics tell only part of the story. Also measure:

• Engagement Levels: Percentage of eligible employees participating
• Sentiment: Post-derby surveys on employee attitudes toward security
• Knowledge Retention: Follow-up quizzes to assess learning
• Behavioral Change: Reduction in real security incidents over time

Step 5: Turning Results Into Action

The derby isn’t just a game – it’s a diagnostic tool to strengthen your security posture.

Celebrate Success

• Host an awards ceremony announcing winners
• Share overall company improvement metrics (but not individual failures)
• Recognize security champions publicly with certificates or trophies

Implement Targeted Training

Use derby results to:

• Deliver just-in-time learning when users click on simulated phishes
• Develop customized training modules for departments with higher vulnerability
• Create role-specific guidance based on the types of attacks different teams fall for

Sustain Momentum

A one-time derby won’t create lasting change:

• Schedule quarterly or bi-annual derbies with fresh themes
• Maintain lower-intensity simulations between major events
• Evolve scenarios based on emerging threats and user feedback

The Secret Ingredients for Derby Success

After analyzing dozens of successful implementations, these factors consistently distinguish effective phishing derbies:

1. Positive Framing: Focus on recognition rather than punishment
2. Executive Sponsorship: Visible C-suite participation and support
3. Realistic Scenarios: Phishing templates that mirror actual threats
4. Immediate Feedback: Real-time responses to reported emails
5. Multiple Paths to Win: Various categories and ways to earn recognition
6. Appropriate Difficulty Curve: A mix of obvious and challenging phishes

By transforming your phishing simulations into engaging competitions, you’ll build a stronger human firewall – one that’s alert, enthusiastic, and equipped to be your organization’s first line of defense against the ever-evolving threat of phishing attacks.

Remember: Security awareness isn’t about catching employees doing something wrong – it’s about empowering them to do something right. A well-designed Phishing Derby does exactly that.

Now it’s your turn. Start planning your derby, and watch as compliance transforms into commitment, and security awareness becomes a source of pride rather than a burden for your team.

Frequently Asked Questions

What is a Phishing Derby?

A Phishing Derby is a gamified security awareness program that transforms standard phishing tests into a positive and competitive event. Instead of penalizing employees for clicking on simulated phishing links, it actively rewards them for correctly identifying and reporting threats, fostering a more collaborative and proactive security culture.

How is a Phishing Derby more effective than traditional phishing simulations?

A Phishing Derby is more effective because it leverages positive reinforcement and gamification to build skills, rather than creating the fear and resentment often associated with traditional tests. By encouraging voluntary participation and celebrating security-conscious behavior with rewards, it turns security awareness from a mandatory chore into an engaging, team-building competition, leading to better knowledge retention and a stronger human firewall.

What are the first steps to starting a Phishing Derby?

The first steps to launching a Phishing Derby are to define clear goals, secure leadership buy-in, and create a robust communication plan. Before you begin, establish what success looks like (e.g., a 30% increase in reporting rates), get your executives on board by explaining the ROI, and announce the event clearly to build excitement and ensure everyone understands the rules.

What kinds of prizes are effective for a Phishing Derby?

Effective prizes for a Phishing Derby typically include a mix of both individual and team-based awards to motivate a wide range of participants. For individuals, consider gift cards for the “Top Reporter” or fun tech gadgets. For teams, a sponsored lunch or a trophy can foster healthy competition. The key is to offer incentives that are meaningful to your company culture.

Will running a Phishing Derby overwhelm my security team with false positives?

A successful derby will likely increase the number of reported emails, but this can be managed efficiently with the right systems in place. This increase is a positive sign of employee vigilance. To handle the volume, establish a dedicated reporting channel and use automation tools or SOAR platforms to help triage simulated phishes from potential real threats, turning a potential burden into a valuable data stream.

How do you measure the success of a Phishing Derby?

The success of a Phishing Derby is measured by tracking both quantitative metrics and qualitative shifts in security culture. Key metrics include improvements in click rates, credential entry rates, and—most importantly—the rate of reporting simulated phishes. Beyond the numbers, you should also measure qualitative factors like employee engagement, sentiment via surveys, and long-term behavioral change demonstrated by a reduction in real-world security incidents.