Running a Phishing Simulation for a Small Team | KaliLinux.net Guide

Even a five-person team can run a phishing drill without turning it into a big project. KaliLinux.net treats it as a short, repeatable exercise: define scope, get consent, run a low-friction simulation, then coach people without shame. Verizon’s 2024 DBIR says 68% of breaches involved a non-malicious human element, which is reason enough for small teams to practice. The point is not to catch employees. It is to make suspicious-email reporting feel normal.

Set the rules before you send anything

Get written approval from the business owner or authorized manager before the first message goes out. Limit the test to company-owned email accounts, avoid personal inboxes, and never collect real passwords or MFA codes. CISA’s