Paubox now offers Security Awareness Training as an add-on to Paubox Email Suite, letting an administrator pick a scenario such as a fake Microsoft login reset and send it to staff. Results show who opened the message, who clicked, and who entered credentials.

A phishing simulation is a fake phishing email that an organization sends to its own employees, landing in the same inbox a real attack would. Nobody is harmed in the process, and the organization gets to see how staff respond before a genuine lure arrives.

Simulations also help meet a legal obligation, since the HIPAA Security Rule requires a security awareness and training program for every workforce member, management included, under 45 CFR 164.308(a)(5).

 

What the HIPAA requirement covers

Section 164.308(a)(5) makes the training program itself mandatory and lists four supporting items as addressable. An addressable item has to be implemented unless the organization documents why a reasonable alternative works just as well.

Those four items are security reminders, protection from malicious software, log-in monitoring, and password management. No training format is prescribed, and the rule sets no fixed frequency for any of them.

Paubox Security Awareness Training keeps campaign history and audit logs for six years. An audit log is a record of who did what and when, so each simulation leaves evidence a regulator can review later.

 

What the largest healthcare study found

Researchers at UC San Diego sent ten simulated phishing campaigns to more than 19,500 UC San Diego Health employees over eight months, in what the university described as the largest study of anti-phishing training to date.

In the first month, 10% of employees clicked a phishing link, while another lure claiming to update the health system's vacation policy drew clicks from 30.8%.

Employees who had just finished their yearly awareness course failed at rates close to those who had completed it months earlier. The researchers concluded that the protection the training resulted in, as commonly deployed, was "simply too small."

Interactive training was linked to a 19% lower failure rate on later lures among employees who completed it. Grant Ho, a study co-author now on the faculty at the University of Chicago, said most people do not engage with the training materials.

 

How much the lure changed the results

Christian Dameff, a study co-author at UC San Diego Health, presented the results at Black Hat USA, an annual security research conference in Las Vegas. He told the audience "it's important to have different lures in your phishing training." According to the same report, training improved results by an average of 1.7%, while individual lures ranged from 10% to 30.8%.

Paubox customers raised a related point during an April 2026 customer session, where attendees noted that training lands better when it feels personally relevant. HR, accounts payable, and sales teams were named as high-risk groups that deserve targeted training.

Paubox Security Awareness Training can run a fresh simulation each month on an unpredictable schedule, and it can generate an AI variation of any template. Administrators can use that to test different departments with scenarios close to their daily work.

 

Opened, clicked, or typed a password

ETH Zurich researchers ran a 15-month phishing study with more than 14,000 employees at one company, and they measured clicks separately from dangerous actions such as submitting credentials.

Paubox reports opens, clicks, and credential entry for each employee, which separates someone who opened a test message and stopped from someone who typed a password into a fake Microsoft page. Follow-up training can then go to the people who reached that final step.

 

Where training sits behind the filter

Embedded training is the short lesson shown right after someone clicks a simulated phish. ETH's study found it did not make employees more resilient, and in some cases it made them more susceptible. Warnings placed on suspicious emails performed well, and employees using a reporting button detected new phishing campaigns quickly over long periods.

Paubox positions training as a second layer behind filtering. Paubox Inbound Email Security works to stop phishing before it reaches employees by reading sender behavior and message intent rather than matching known bad content, and training addresses whatever still gets through.

Both run in the same Paubox account alongside HIPAA compliant email encryption, so organizations already using Paubox for email don't need a separate vendor to train their staff.

 

What a 2024 follow-up study found about attention

ETH Zurich researchers returned to embedded training in a separate study that combined measured employee behavior with surveys of how staff perceived the training, across a larger and more varied workforce. Their paper confirmed that forcing extra training on the employees who fall for phishing most often brought no benefit, and it found susceptibility tied more closely to a lack of attention than to a lack of knowledge about phishing.

 

FAQs

Does HIPAA require phishing simulations?

No rule names simulations. HIPAA requires a security awareness and training program under 45 CFR 164.308(a)(5), and simulations are one way to run and document that program.

 

How often should simulations run?

The Security Rule sets no frequency. Paubox can run a new simulation automatically every month on an unpredictable schedule.

 

Does training reduce click rates?

Only slightly in the UC San Diego Health trial. Interactive training cut later failure rates by 19% among employees who completed it, though most employees did not engage with the material.

 

Why track credential entry separately from clicks?

A click reaches the attacker's page, while credential entry hands over the account. Separating them shows which employees reached the step that leads to account takeover.

 

Can training replace email filtering?

No. Filtering such as Paubox Inbound Email Security aims to stop phishing before staff sees it, and training covers what gets through.