I work at a small company that uses Microsoft 365 and want to run authorized phishing-awareness campaigns. We would like to measure the campaign funnel—delivery, opens, clicks, and attempted form submissions—so we can identify weaknesses and tailor training. I have tested GoPhish with MailHog, but I am unsure how best to create safe landing pages for scenarios such as password-expiration or account-reset messages that resemble familiar Microsoft workflows without collecting real credentials. What tools, templates, or design approaches do other organizations use? Is it better to build pages from scratch, use GoPhish templates, or choose a managed platform? Microsoft Attack Simulation Training seems useful, but our current licensing may not include it, so recommendations suitable for smaller companies would be especially helpful.
4 Answers
GoPhish can work well for a small, controlled program. I would create simple, clearly bounded landing pages rather than cloning a real sign-in experience: record only that the link was visited or that a dummy form was submitted, never accept or store passwords, and show an immediate educational page explaining the warning signs. Keep the lookalike elements limited to what is necessary for the lesson and have written approval, testing safeguards, and an incident contact before launching.
If you already have the appropriate Microsoft 365 security licensing, Attack Simulation Training is probably the simplest route because it integrates with mail flow, reporting, and follow-up training. Make sure every simulated page clearly prevents real credential submission and that your licensing covers all participating users rather than relying on a single-seat workaround.
The training matters more than making the page extremely convincing. Start with common scenarios, explain what clues users should notice, and measure improvement over several campaigns instead of shaming individuals. Separate technical metrics from coaching, offer a simple way to report suspicious messages, and provide different examples for technical and nontechnical staff.
Managed platforms such as KnowBe4, Hoxhunt, Huntress, and usecure provide ready-made scenarios, branded templates, landing pages, reporting, and automated training. They cost more than a home-built setup, but they save a lot of time on mail injection, allowlisting, campaign scheduling, and consistent user education. The best choice depends on whether you value automation, custom courses, or Microsoft integration most.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures