Lion Cipher Lab
Run an authorized phishing-awareness simulation with GoPhish
- SOC Analyst / Blue Team
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Phishing is the front door of most real breaches, and the only defence that scales is a workforce that pauses before it clicks. An authorized phishing simulation is how security teams measure and build that reflex: you send a harmless, controlled fake to people who have agreed to a training program, then use who opened and clicked to decide where to teach next. Done with authorization, consent, and care, it turns an abstract risk into a concrete, improvable number. Done badly — by surprise, to shame people, or by capturing real credentials — it destroys trust and teaches employees to hide…
What you'll learn
- running an authorized phishing-awareness simulation
- obtaining and scoping written authorization
- installing and configuring GoPhish
- building a sending profile, landing page, and email template
- launching a campaign and reading open and click rates as a training metric
- running security awareness ethically, without shaming staff
Steps in this lab
- Authorization first — the rule that comes before any tool
- Design it as training, not a trap — scope, privacy, and no shaming
- Install GoPhish on your own test machine
- Create a sending profile — how the mail gets out
- Build the landing page and the email template
- Add a consenting test group — or just yourself
- Launch a small campaign and watch it safely
- Read the results as a training metric — not a scoreboard
- Why the ethics are the skill