.svg)
.svg)
.svg)
.svg)
.svg)
A phishing campaign comes with a calendar. Someone picks a theme, builds the template, chooses the audience, launches, waits, pulls the report, briefs management and starts again next quarter. For a security awareness manager on a lean team, that cycle is the program, and it quietly decides how often anyone is tested. This post is for the people who run that cycle and want to see what autonomous phishing simulation looks like once it is gone.
In short: Autonomous phishing simulation replaces the campaign cycle with agentic AI that picks each person's next simulation, difficulty, trigger and timing. You set guardrails once, and your team acts only when the system asks.
Why Campaigns Cap Your Program
A campaign treats the workforce as one audience. Everyone gets the same lure at the same moment, so the result describes the template as much as the people. NIST built its Phish Scale with this in mind. It rates a phishing email's content across five elements to give a difficulty of low, medium or high, so a click rate can be read against how hard the lure was to detect. NIST describes the method in its own words.
Most breaches run through people. Verizon's 2026 Data Breach Investigations Report found that human involvement contributed to 62% of breaches in 2025. Against that, a quarterly campaign leaves up to three months with no fresh signal on any individual.
That is the gap a campaign calendar leaves open. Closing it with more campaigns means more planning, more launches and more reviews, which is exactly what a small team cannot add.
What Autonomous Phishing Simulation Means
Autonomous phishing simulation is a program where the system, not an administrator, decides what each person receives and when. Continuous phishing simulation is the visible result: simulations reach each person at their own pace all year instead of in waves. You will also see it called campaignless phishing or phishing without campaigns, and both phrases describe what disappears: the campaign itself, with its audience list, launch date and end date.
Agentic AI phishing simulation is how that works in practice: an agent looks at the individual and chooses the next step. The wider question of what automation should run and what a team keeps is covered in Automated Phishing Simulation: What Runs, What You Keep. This post stays on the model where the campaign is removed.
How Graybait Runs Without Campaigns
Graybait is the Fraus phishing program built on this model. Setup is four steps, then it runs for twelve months with minimal administrative effort:
- Connect the workforce.
- Set guardrails.
- Choose an objective.
- Activate.
From there the agentic AI picks or generates each employee's next simulation from their Human Risk Profile. It sets the difficulty, theme, psychological trigger and timing for that person. Lures match the person's role, context and history, so someone in finance and someone in facilities need not receive the same message.
Difficulty moves with the individual. It rises as a person keeps spotting attacks, and a method is retired once that person has beaten it. Frequency follows each person's risk, within the limits an admin sets. A colleague who keeps spotting lures is not pulled into the same routine as one who struggles.
What Happens When the System Asks
After activation, the team steps in only when the system asks. The work shifts from producing simulations to responding to requests, and the new way to stall is a request that nobody owns. Name one person who answers, and a backup, before you activate.
The same principle runs through other Fraus agentic work. In Agentic Automation Rules, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval, and every agentic action is logged for audit. Asking first is part of the design.
Then comes the long middle. The program runs for twelve months after the four setup steps, with no launch dates inside it.
Inside that year, one person is moving to harder lures because they keep spotting attacks. Another has beaten a method, so it is retired for them. A third is tested more often because their risk is higher. Your calendar shows none of this, which is why reporting needs a different shape.
Reporting With No Campaign Report
Management is used to a report at the end of each campaign. With none, you report what Graybait tracks for each person and across the workforce:
- Individual susceptibility over time. A trend for each person instead of one rate per wave, so you can say whether people are getting harder to fool rather than how a single template performed.
- Weakness coverage. How far the program has reached into each person's weak spots, which answers what has not been tested yet.
- Difficulty progression. How the difficulty has risen as people keep spotting attacks, which shows leadership that the program is not stalling at an easy level.
Risk also needs a home outside the simulation. Odin scores each employee's risk continuously and weights it by role criticality, which helps you read these views next to the rest of the picture.
Leaving the Campaign Calendar
Go back to the calendar from the start. Switching means stopping a few habits: building templates, setting launch dates and writing an end-of-campaign report. The slot you held in the management meeting stays, and the three views above fill it.
Staff and managers need a short heads-up. Simulations now reach each person on their own schedule through the year, so colleagues are less likely to compare notes about the phishing test going round this week. Managers should expect to be asked for context when a pattern needs a conversation.
Your next step is to pick who answers the system and which management meeting will receive the first reporting views. Then see how Graybait handles the rest.
Frequently Asked Questions
What is autonomous phishing simulation?
It is a phishing simulation program where agentic AI, not an administrator, decides what each person receives, how hard it is and when it arrives. There are no campaigns to plan, launch or review. The team sets limits and an objective at the start, then responds when the system asks for input.
Does phishing without campaigns mean losing control?
No. You set the guardrails and choose the objective before activation, and frequency follows each person's risk within the limits an admin sets. What you give up is the manual work of building and launching each wave, not the authority over what the program may do.
How is this different from automated phishing simulation?
Automation can mean a scheduler that still sends campaigns on a timer. The campaignless model removes the campaign, so each person gets a simulation chosen for them. The published guide on automated phishing simulation explains what automation should run and what a team keeps.
How does Graybait get started?
Setup is four steps: connect the workforce, set guardrails, choose an objective and activate. It then runs for twelve months, and the team steps in only when the system asks. Talk to Fraus about your environment and objectives before choosing guardrails.
.png)
.png)
