From the Huntress 2026 State of Phishing report: In Huntress's analysis of suspicious emails reported to its Managed SAT platform in 2025, e-signature requests were the most common lure theme (14.2%). PDFs made up 57.7% of observed phishing attachment extensions, and urgency and trust appeared in 56.3% of analyzed emails. These figures describe Huntress's observed sample—not all phishing activity.

Download the 2026 State of Phishing Cyber Threat Report

Look at what's in that sample: e-signature requests, invoices, voicemail notifications. Attackers don't need anything exotic. They borrow the look of work people already do all day, then add pressure and a familiar-feeling sender.

That's why relevance matters. A simulation built on generic templates may not match what's landing in your employees' inboxes.

Use these seven checks to compare vendors on equal footing.

1. Relevant, realistic scenarios. Ask whether scenarios reflect current lures and attacker techniques or mostly familiar template tests. Confirm which channels are covered (email, SMS, QR codes, voice) and how scenarios stay current.
2. Coaching tied to the outcome. The best moment to teach is right after someone clicks. Look for immediate, constructive feedback and, where available, follow-up that fits the person's role or risk.
3. Useful measurement. Click rate alone is an incomplete picture. Look for reporting behavior, time to report, repeat trends, training follow-through, and improvement over time. Vendors score things differently, so don't assume numbers compare across platforms.
4. Manageability. Who builds, schedules, and runs campaigns? Managed delivery saves time but gives you less hands-on control. Self-service gives you control but costs staff hours. Know which trade-off you're signing up for.
5. Integrations and scale. Confirm Microsoft 365 support, user provisioning, report-phish workflows, and any APIs or exports you need. If you're an MSP (managed service provider), add multi-tenant support to the list.
6. Employee-friendly practice. Simulations should coach, not shame. Non-punitive, privacy-conscious exercises build the reporting habit you want.
7. Clear cost and scope. Ask about licensing, user minimums, add-ons, onboarding, and what "managed" actually includes. Get it in writing.

Phishing simulations give employees a safe way to practice recognizing and reporting threats. Watch how Huntress turns real-world phishing behavior into realistic simulations, timely coaching, and actionable insight for security teams.

Start with how much time you actually have.

• Little time to run campaigns? Compare managed services, and ask exactly what the vendor runs for you.
• Want hands-on control? Compare self-service customization, integrations, and the internal effort each one takes.
• Running an MSP? Prioritize tenant separation, client reporting, automated rollout, and per-client economics.
• Building a broader SAT program? Check how simulations connect to lessons, reporting, and your recurring program goals.

Whichever way you learn, pick the vendor that helps employees practice recognizing and reporting relevant threats, links outcomes to useful training, and gives you evidence of progress. A pile of templates and a click-rate number won't do that.