A dental office phishing drill should test whether employees can recognize a suspicious message and get it to the right responder safely. Obtain written authorization, teach the reporting route first, and use a simulation that cannot collect credentials, deliver malware or trigger a real payment. Review both employee decisions and the office's response to reports.
The goal is a practiced handoff, not a list of people who clicked. A drill supplements the office cybersecurity program; it does not prove that email protections work, satisfy every training obligation or predict the outcome of a real attack.
Approve the exercise boundaries before sending anything
Have the owner, IT or security lead, and appropriate personnel reviewer approve a short exercise brief. If an outside provider runs it, include that provider's exact activities and data handling in the approval. The recommendations below describe a bounded office exercise, not a government-mandated drill format.
Record these decisions:
- which staff groups and practice-owned mailboxes are included;
- the delivery window and a named person who can stop the exercise;
- the learning objective and harmless scenario;
- the approved sending system and destination, if a link is used;
- exactly which events are measured and who may see individual results;
- the retention period for exercise data under the office's reviewed policy;
- how to distinguish simulation reports from genuine incidents;
- when and how staff receive the debrief.
Exclude patient addresses, external vendors, personal accounts and unrelated systems. Do not spoof a real employee without the specifically approved exercise arrangement. Avoid themes involving job loss, medical diagnoses, personal emergencies or promised bonuses; they add distress without being necessary to practice reporting.
Teach the safe response before measuring it
Show staff the reporting button or other approved route on the devices they actually use. Confirm that someone monitors the destination and that a backup receives reports when the primary responder is away.
Give employees a short sequence: pause the requested action, use the approved reporting route, and wait for guidance. Do not ask them to open attachments, inspect suspicious websites or forward a message to the whole team to determine whether it is dangerous.
The FTC recommends verifying a suspicious request through a phone number or website already known to be genuine, rather than contact information supplied by the message. Apply that habit to office requests for payment changes or account information. FTC guidance on checking suspected phishing
Test the reporting route with a clearly labeled practice message before the exercise. If it fails, fix it and defer measurement. Connect the instruction to the onboarding checklist so a new employee receives the same opportunity to learn it.
Choose a harmless scenario with one decision
For a first exercise, an announced tabletop may be enough. Display a fictional supplier message asking the office to review an unexpected delivery update. Ask each participant what they would do and have them demonstrate the reporting route with a labeled sample.
A later authorized inbox simulation can test the same decision during ordinary work. Keep any destination under the approved exercise operator's control. A clicked link should lead only to a clearly identified training page, with no login form, download, payment instruction or request for personal information.
Collect no passwords, authentication codes, session tokens or patient data. Do not send a document containing macros or executable content. Do not weaken practice-wide email protection just to obtain a larger sample. If the message is blocked, record that technical outcome separately and have IT decide whether another safe training format is appropriate.
Use a pilot mailbox to check delivery, mobile display, reporting, landing-page behavior and stopping the exercise. The pilot should demonstrate the approved safeguards before messages reach participants.
Measure reporting without turning a small sample into a ranking
Agree on counting rules before the drill. Treat mailboxes and people as different units: a shared reception mailbox does not establish which employee saw a message. Record out-of-office staff, delivery failures and other exclusions consistently.
| Measure | Question it answers | Important limitation |
|---|---|---|
| Confirmed delivery | Which included mailboxes received the exercise? | Delivery does not establish attention |
| Unique reports | How many participants used the approved route? | Count each person once; handle shared mailboxes separately |
| Report timing | How long after delivery did reports arrive? | Compare within working windows and similar duties |
| Confirmed interaction | What harmless exercise action occurred? | Technical events need verification before attributing them to a person |
| Response acknowledgment | Did the assigned responder act on a report? | This tests the office's handoff, not employee awareness alone |
NIST's Phish Scale provides a method for rating how difficult an email is for people to identify as phishing. Use that context when interpreting exercise results; different message difficulty can make raw click or report rates misleading. NIST Phish Scale User Guide
For an illustrative result, suppose 12 included employees each receive a message in an individual mailbox. Seven report it, including two who report after clicking. Record seven reporters out of 12 and distinguish the two report-after-click events. Do not erase those reports or label the other five employees compromised; the exercise has not established that.
Ask the operator to distinguish automated link checks from confirmed human actions where possible. Treat uncertain events as uncertain. A dashboard number should not become an accusation without supporting evidence.
Coach privately and repair the reporting process
After the exercise, explain the scenario to everyone and identify the decision it was meant to test. Share aggregate learning points without publishing names, screenshots of individual results or a failure leaderboard.
In private coaching, ask what the employee noticed, what made the request plausible, and whether the reporting tool was easy to find. Practice the next action together. A person who clicked and then reported promptly needs reinforcement of reporting alongside coaching on the initial decision.
Review the responder's performance too. Did a report receive acknowledgment? Did staff know whom to contact if the usual manager was absent? If that ownership was unclear, update the front-desk escalation matrix.
Give each process finding a correction and a retest. Examples include a missing reporting button, an unmonitored mailbox or unclear backup coverage. These are concrete improvements the manager can verify without claiming that a lower click rate proves the office is secure.
Treat an unexpected real event as real
Before launch, tell the exercise operator how to stop if someone reports a different suspicious message, discloses real credentials or identifies possible exposure. Never dismiss an unfamiliar report because a drill happens to be running.
Pause the exercise when necessary and activate the established incident-response process. Preserve relevant evidence through the security team's instructions; employees should not investigate accounts or devices on their own. Privacy, legal and technical leads determine the actual incident response and any notification obligations.
Finish with an exercise record showing scope, delivery limits, counting rules, aggregate findings, private coaching completion and the specific handoff to retest. That makes the drill useful even when the most important discovery is a reporting process the office needs to repair.
