Phishing Simulation & Social Engineering Testing

Article 30 of the Guidelines for Cyber Security Control of TWSE/TPEx Listed Companies requires an annual email social-engineering drill with retained records. ThunderShield runs tiered, priced-by-mailbox phishing simulations that measure employee resilience and deliver an audit-ready report.

Phishing Simulation Testing Process

Realistic social engineering simulation that measures and improves employee security awareness

  1. Planning and Preparation：Define target user groups and simulation scenarios together with your team.
  2. Email Design：Craft realistic phishing email templates based on attack patterns.
  3. Campaign Launch：Deliver simulation emails to selected employees.
  4. Result Collection：Collect behavioral data including click and submission rates.
  5. Analysis and Training：Analyze outcomes and provide focused awareness training recommendations.

Frequently Asked Questions

What is phishing simulation testing?

Phishing simulation testing sends controlled, realistic phishing emails to measure how employees identify and respond to social engineering attempts.

Will phishing simulation disrupt daily operations?

No. Campaigns are planned to minimize disruption while still generating realistic behavior data for risk analysis and training.

How are results used after the simulation?

Results are used to identify high-risk patterns, prioritize coaching, and build targeted security awareness programs for teams and individuals.

How many drills should we run per year?

Article 30 of the Guidelines for Cyber Security Control of TWSE/TPEx Listed Companies requires at least one drill annually. Government agencies, under the Regulations on Reporting, Response and Drills for Cyber Security Incidents, run a social-engineering drill every six months. The market trend has shifted toward higher-frequency, smaller batches, which better mirror real attack cadence and reduce disruption from any single drill.

Could the drill damage our reputation or trigger email filters?

We send drill emails from similar but distinguishable test domains and confirm allowlisting with your IT team beforehand, so the drill doesn't trigger spam filters or disrupt normal mail flow.

Can the report be used directly as audit evidence?

Yes. The report includes an executive summary, a comparison against the thresholds currently used for government agency drills, and can be retained as a record for regulatory or customer audits.

How is personal data in the recipient list handled?

The recipient list — name, email address, department, and job title — is personal data. It is processed only by authorized ThunderShield personnel, only within the scope necessary for this drill, and is destroyed after the report is accepted. Individual-level behavioral records are released only to your designated contact; statistics in the report are presented by department or group.

Contact ThunderShield for a consultation · View pricing plans