.svg)
.svg)
.svg)
.svg)
.svg)
An email asking an accounts payable clerk to confirm a supplier's new bank details the day before a payment run is a different test from the same email sent to someone in facilities. The words are identical. The odds of spotting it are not.
This post is for security awareness managers and CISOs in the UAE and wider GCC who send one template to the whole organization and want to know what an adaptive phishing simulation does differently, and how to judge its results.
In short: An adaptive phishing simulation matches each person's lure to their role, history, language and proven difficulty level, raises the bar for strong performers, supports those who struggle, and reads every result against how hard the email was.
What Adaptive Phishing Simulation Means
A fixed campaign picks one template, sends it to everyone on one date and reports one click rate. It is easy to run, and it answers a narrow question: how did this email perform against this crowd?
An adaptive program asks what the next simulation should be for each person. Role decides which story is believable. Behavior history shows what the person has clicked, reported or ignored before. Language decides whether the message reads as native. The difficulty level records how hard an email they have already handled.
Over a year the gap widens. Strong performers keep meeting emails worth their attention instead of coasting through easy ones, and people who struggle get lures they can learn from instead of the same failure on repeat. Who or what sends each email is a separate question, covered in Automated Phishing Simulation: What Runs, What You Keep. The rest of this post is about how each email is chosen.
How Difficulty Is Calibrated
Adaptation only works if difficulty is measured the same way each time. A well-documented public method comes from NIST. Its Phish Scale rates how hard a phishing email is to detect from two inputs: the cues in the message, and how well its premise fits the audience.
Cues are the features that should tip a reader off or push them to click. NIST's user guide groups them into errors, technical indicators such as look-alike domains, visual presentation, language and content such as urgency, and common tactics such as impersonating a trusted sender. Between 1 and 8 cues counts as few, 9 to 14 as some, and 15 or more as many. Fewer cues make a harder email.
Premise alignment asks how closely the story matches the recipient's work. Someone who knows the audience scores four elements: whether the email mimics a workplace process, has workplace relevance, lines up with other situations or events, including ones outside work, and raises concern about the consequences of not clicking. A fifth element, prior training or warnings on this kind of lure, is subtracted. Strong alignment makes an email harder.
Combine the two and an email with few cues and strong alignment is rated very difficult, while one with many cues and weak alignment is the least difficult. Because the scoring depends on the audience, the same email can earn a different rating for finance than for facilities. That is the case for adapting, built into the rating itself.
NIST's own results show how much it matters. NIST ran ten workplace exercises over more than five years, and five of them show the spread. A safety-requirements email rated very difficult drew clicks from 49.3% of recipients, and an unpaid-invoice email, also very difficult, drew 20.5%. A voicemail lure rated moderately difficult drew 11.6%, a security-token email 8.7%, and a software-update email rated moderately to least difficult 3.2% (Steves, Greene and Theofanos, Journal of Cybersecurity).
The authors note that premise alignment appeared to influence clicks more than the number of cues. An email with more mistakes but a premise that fits the work can draw more clicks than a cleaner one, so calibration has to look at the audience as well as the message. A rung on the ladder is simply a difficulty level with a person standing on it.
How the Ladder Moves Up and Down
Each person starts on a rung set by their role and earlier results, and the next simulation is drawn from that rung. What matters is the rule for moving, and there are two directions.
Up. When someone reports a simulation at their level, the next one comes from a higher rung: fewer cues, a premise closer to their real work, or a different channel such as SMS or a QR code. The reward for doing well is a better test.
Down. When someone clicks, the next simulation steps back to a level they can learn from, and the miss triggers short training on the cue they overlooked. Failing a very difficult email tells you something different from failing an obvious one, and the ladder treats the two differently.
Four rules keep the ladder honest. The last one is easy to skip, and it decides whether the results mean anything.
- Move one rung at a time, so a single result never swings difficulty sharply.
- Count a report as the strongest pass, stronger than simply not clicking.
- Hold the rung when the evidence is thin, such as after one result or a long absence.
- Log the difficulty of every send, so results stay comparable months later.
Role, Channel and Language
Role sets the premise. A supplier bank-detail change fits finance, a shared-document request fits a project team, and a student-record query fits a registrar. The same cue count rates differently for each group, because the story is believable to one and irrelevant to the others.
Channel follows the threat in your market. In February 2026 the UAE Cyber Security Council reported that scam messages had risen by about 35% over the previous year, with impersonation of government entities and trusted companies and SMS-based fraud among the forms it warned about (Gulf News). An adaptive program reflects that with government-service and bank-verification premises, delivered by SMS or QR code where staff are exposed that way.
Language is where a single template does worst. An employee who works in Arabic all day and receives an English-only simulation is tested on a message they would rarely meet in that form, so the result tells you little. People who read both can receive either, and which one they respond to becomes useful data.
Whitebait, the Fraus phishing simulation product, provides Arabic and English templates and tracks reporting rate next to click rate, so each person can be tested in the language they actually work in.
Reading Results Against Difficulty
Adaptation changes how you report. If one person received a very difficult email and another an obvious one, an average click rate blends two different tests. NIST's guide says click and reporting rates alone give a single point of insight, and difficulty supplies the context: very difficult emails may reasonably draw high click rates, while many clicks on a least difficult email point to an audience that needs additional training.
In practice, report results per rung rather than per campaign, show the reporting rate beside the click rate, and watch the trend. A cohort that clicks 20% on very difficult emails while reporting more of them each quarter is improving, even though its headline number looks worse than a cohort clicking 3% on easy ones. Security Awareness KPIs for the Board on One Page shows how to summarize this for executives.
Start With One Role Group
Go back to the accounts payable clerk. A bank-detail lure timed to the payment run is far harder for that person to dismiss than for anyone else in the company, which is why a single company-wide click rate hides it.
This quarter, pick one role group, usually finance. Rate your last three simulations for that group on cues and premise fit, and put the click and reporting rates next to each rating. If the ratings are all the same, you have found where the ladder starts, and the next simulation should sit one rung higher for those who reported and one lower for those who clicked.
Frequently Asked Questions
What is an adaptive phishing simulation?
It is a program where each person receives simulations chosen for them rather than one template for everyone. The choice draws on role, behavior history, language and the difficulty level the person has already handled. Strong performers get harder tests, people who struggle get support, and each result is read against the difficulty of the email.
How does adaptive phishing simulation decide difficulty?
It rates each email on two things: the cues that could give it away, and how well the premise fits the recipient's work, as in NIST's Phish Scale. Few cues and a strong fit make an email hard. The person's earlier results then decide which rung of difficulty they receive next.
How is adaptive different from a fixed phishing campaign?
A fixed campaign sends one template to everyone and reports one click rate. An adaptive program changes the lure, channel, language and difficulty per person and keeps going all year. Its reports compare results at the same difficulty, so a low click rate on an easy email is not mistaken for strength.
Does adaptive simulation work in Arabic and English?
Yes, provided the templates exist natively in both languages and language is set per person. Premises should be written for Arabic readers, not translated from English. Whitebait provides Arabic and English templates, so employees can be tested in the language they work in. Rate each version's difficulty on its own, because cues and premise fit can change in translation.
.png)
.png)
.png)
