Quick Answer: What a Phishing Simulation Costs in India
A phishing simulation programme in India costs roughly ₹250 to ₹900 per user per year when a partner runs it for you. Consequently, a 100-person company usually pays ₹25,000–90,000 annually. A one-off phishing simulation exercise, run once with a written report, typically costs ₹35,000–1.2 lakh depending on how many people and templates are involved.
However, price is the least interesting part. Furthermore, a badly run programme can damage trust without improving safety. This guide explains how a phishing simulation actually works, what good looks like, and how to measure whether it changed anything.
What a Phishing Simulation Actually Is
A phishing simulation is a controlled fake attack. In short, your security partner sends realistic but harmless phishing emails to your staff. Nothing malicious runs. Instead, the system records who opened the message, who clicked, who entered credentials on a fake page, and who reported it.
Afterwards, anyone who clicked receives short training immediately, while the moment is still fresh. Over several rounds, the pattern shifts. In other words, people stop clicking and start reporting, which is the outcome that actually protects the business.
Importantly, a phishing simulation is a training tool, not a test people should fear. Because of that, the framing you use internally matters as much as the software you buy.
Why Indian Businesses Run Phishing Simulation Programmes Now
Three pressures arrived at once, and together they changed the calculation for Indian companies.
- The money is real. The FBI Internet Crime Complaint Centre logged 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion. Meanwhile, recovery is getting harder: successful transfer freezes fell from 66% to 58% year on year.
- Regulators now expect proof. India’s Digital Personal Data Protection Rules were notified in November 2025, and penalty enforcement begins in May 2027. Failure to apply reasonable security safeguards carries penalties reaching ₹250 crore.
- Attackers write better English now. Generative tools removed the spelling mistakes that used to give phishing away. Therefore the old advice about “bad grammar” no longer protects anybody.
As a result, awareness training moved from a nice-to-have to a control that auditors, insurers and enterprise clients ask about directly.
Phishing Simulation Pricing in India, Broken Down
Pricing follows two models. Firstly, some vendors sell a platform licence per user. Secondly, service providers sell a managed programme where somebody else designs, runs and reports on every campaign.
| What you buy | Typical India price | Best suited to |
|---|---|---|
| Platform licence only | ₹180–450 per user per year | Companies with an internal security team |
| Managed phishing simulation programme | ₹250–900 per user per year | Most SMEs and mid-market firms |
| One-off phishing simulation exercise | ₹35,000–1.2 lakh | Compliance evidence or a board-level wake-up |
| Simulation plus full awareness curriculum | ₹600–1,400 per user per year | Regulated businesses and BPO operations |
| Executive-focused spear phishing test | ₹40,000–90,000 per round | Finance and leadership teams |
Notably, price per user falls sharply above 250 seats. Below 50 people, most providers apply a minimum engagement fee, so very small teams often pay a flat ₹30,000–50,000 a year instead.
What should be included in the price
- Campaign design and India-relevant templates, not only American examples.
- Landing pages and training content in English, and ideally Hindi.
- Immediate micro-training for anyone who clicks.
- A written report with click rate, report rate and department breakdown.
- A quarterly review call to agree the next campaign.
If a quote lacks the report and the review call, you are buying software rather than a programme. Consequently, results tend to plateau after the first round.
How a Phishing Simulation Campaign Runs
A serious programme follows six stages. Moreover, each stage exists for a reason, so skipping one usually shows up in the numbers later.
1. Baseline
Initially you run one campaign with no warning and no training. This gives you an honest starting click rate. Without a baseline, you cannot prove improvement to a board or an auditor.
2. Template design
Next, templates are written to match how your staff actually get email. For Indian offices that usually means courier notifications, GST or PF portal alerts, HR policy updates, and invoice or vendor payment requests.
3. Launch and observation
Then emails go out in staggered batches over several days. Staggering matters, because otherwise the first person to spot it warns everyone on the floor within minutes.
4. Immediate training
Anyone who clicks lands on a short training page straight away. Ideally this takes under three minutes. Long courses at this moment simply get closed.
5. Reporting
Afterwards you review click rate, credential submission rate, report rate and time to first report, broken down by department and seniority.
6. Repeat
Finally you repeat every four to eight weeks with rising difficulty. Annual training alone changes very little, whereas regular, short exposure does.
The Phishing Simulation Metrics That Actually Matter
Most reports lead with click rate. Nevertheless, click rate alone is a weak measure. These four numbers tell you far more together.
| Metric | What it means | A healthy direction |
|---|---|---|
| Click rate | Share of staff who clicked the link | Falling from 20–30% to under 5% over a year |
| Credential submission rate | Share who typed a password on the fake page | Should approach zero fastest |
| Report rate | Share who reported the email to IT | Rising above 40% is a strong signal |
| Time to first report | Minutes from send to the first alert | Under 10 minutes means your team can react |
Above all, report rate is the number to chase. A workforce that clicks occasionally but reports quickly is safer than one that clicks rarely and says nothing. Because your security team needs warning, silence is the real enemy.
Typically, Indian organisations start somewhere between 18% and 32% click rate in the baseline. After four campaigns, single digits are normal. Meanwhile report rate usually climbs from under 5% to somewhere near half the workforce.
Mistakes That Make a Phishing Simulation Backfire
A phishing simulation can absolutely go wrong. In fact, we have seen each of these damage a programme.
- Naming and shaming. Publishing a list of people who clicked destroys reporting. Nobody admits a mistake to a team that punishes mistakes.
- Cruel bait. Fake bonus letters, appraisal results or layoff notices generate huge click rates and lasting resentment. Avoid them.
- Testing without training. A test that produces a statistic and nothing else teaches nobody anything.
- Running it once. A single annual exercise measures a moment. It does not build a habit.
- Excluding leadership. Senior staff are the most valuable targets, so exempting them removes the point.
Instead, treat every click as a system failure rather than a personal one. Additionally, thank people who report, publicly and quickly. That single habit moves report rate faster than any software feature.
Where Phishing Simulation Fits Alongside Technical Controls
Training complements filtering. Certainly it does not replace it. Consider the layers in order.
- Email authentication. SPF, DKIM and DMARC stop attackers spoofing your own domain.
- Filtering. A modern gateway removes most bulk phishing before anyone sees it.
- Multi-factor authentication. Even a stolen password fails without the second factor. Our guide to multi-factor authentication covers the options.
- Detection and response. When something slips through, managed detection and response shortens the time to containment.
- People. The phishing simulation programme handles what technology cannot: judgement under time pressure.
Realistically, some phishing always arrives. Therefore your staff are not the last line of defence by accident. They are simply the layer attackers work hardest to reach.
Legal and HR Points to Settle Before You Start
Simulated attacks touch employment matters, so agree the rules first. Otherwise a successful programme can create an avoidable dispute.
- Get written sponsorship. HR and leadership should approve the programme before the first campaign, in writing.
- Say it in the policy. Your acceptable use or security policy should state that simulated tests happen. Staff need not know when.
- Agree the consequence model. Training for repeat clicks is reasonable. Disciplinary action for a first click is not.
- Handle data carefully. Click data is employee data under the DPDP framework. Accordingly, limit access, set a retention period and document both. Our DPDP Act compliance checklist covers this.
- Keep the evidence. Auditors and clients ask for programme records, and CERT-In compliance work benefits from the same trail.
Choosing a Phishing Simulation Partner in India
Platforms differ less than the service around them. Hence these five questions separate providers quickly.
What does a phishing simulation service provider in India do? A provider plans the campaign calendar, builds templates that match how your teams actually work, sends the simulated emails, gives short training to people who click, and reports click and reporting rates by team so management can see where the risk sits. Novotron’s email phishing exercise service covers simulation campaigns, employee response measurement, risk insights and training support for businesses in Noida and across Delhi NCR, as one part of its cyber security services in Noida.
- Do your templates reflect Indian workflows, or only American ones?
- Who writes the campaign plan, and how often do we review it?
- Can training run in Hindi as well as English?
- How is our employee data stored, and where?
- What happens when somebody reports a real attack during a campaign?
That last question matters more than people expect. Real attacks arrive during simulations, so your provider needs a clear path to escalate a genuine incident immediately.
What Results Look Like After Twelve Months
Programmes that run properly follow a fairly consistent curve. Firstly, click rate drops steeply after campaign two. Secondly, it flattens somewhere between 3% and 8%, because a residual group always clicks. Thirdly, report rate keeps climbing long after click rate settles.
For example, one 180-person services firm in Noida began at a 26% click rate with a 4% report rate. Six campaigns later, clicks sat at 6% and reports at 47%. Crucially, the security team started hearing about suspicious email within eight minutes rather than never.
Ultimately that is the return. Not a perfect workforce, but an early warning system made of people.
Phishing Simulation Templates That Work in Indian Offices
Generic template libraries underperform here, because the lures do not match daily life. In contrast, locally grounded emails produce honest results.
| Template theme | Why it works | Typical click rate |
|---|---|---|
| Courier or delivery notification | Everyone orders something | High, 25–40% |
| GST, PF or income tax portal alert | Feels official and urgent | High, 20–35% |
| HR policy or appraisal cycle update | Personally relevant | Very high, but use with care |
| Vendor invoice or payment change | Targets finance directly | Moderate, and the costliest to miss |
| Microsoft 365 password expiry | Familiar and routine | Moderate, 15–25% |
| Internal IT ticket update | Trusted internal sender | Moderate, and excellent for training |
Start with moderate difficulty. Then increase it gradually. Otherwise your first campaign produces a frightening number that tells you nothing useful about progress.
Difficulty should rise in steps
Early campaigns can carry small clues, such as a slightly wrong sender domain. Later campaigns should remove them. Eventually you can run targeted spear phishing against finance and leadership, since those are the people attackers research properly.
Who to Target First
If budget limits your scope, sequence by exposure rather than by headcount.
- Finance and accounts payable. They move money, so vendor payment fraud lands here first.
- Leadership and their assistants. Authority makes their accounts valuable and their requests hard to question.
- HR. They hold personal data and open attachments from strangers all day.
- IT and admin staff. Their credentials unlock the most systems.
- Everyone else. Broad campaigns follow, once the high-risk groups have a rhythm.
Nevertheless, do not leave the wider workforce untested for long. Attackers frequently enter through an ordinary account, then move sideways towards the valuable ones.
Build It Yourself, or Buy the Programme?
Both routes work. However, they fail in different ways, so choose deliberately.
Building in house suits companies with a dedicated security person. The licence costs less, and you keep full control of timing and tone. On the other hand, campaigns quietly stop when that person gets busy, which is exactly what happens during an incident or an audit.
Buying a managed phishing simulation programme suits everyone else. Somebody outside your business owns the calendar, writes the templates and produces the report. Consequently the programme survives busy quarters, staff changes and competing priorities.
As a rough rule, under 250 staff without a full-time security hire, buy it. Above that, or with a security team already in place, a licence plus internal ownership usually costs less over three years.
What Happens When Somebody Clicks a Real One
A phishing simulation programme builds the habit. Even so, you still need a plan for the day a genuine attack succeeds. Speed decides the damage.
- Contain the account. Reset the password, revoke active sessions and check for new inbox rules. Attackers add forwarding rules within minutes.
- Check what moved. Look for mailbox exports, unusual file downloads and any changes to bank details in your finance system.
- Tell the right people. CERT-In expects reporting within six hours of noticing an incident, and the DPDP Rules add a 72-hour report to the Data Protection Board where personal data is involved.
- Warn the workforce. Say what the email looked like. Colleagues who received it will then recognise it.
- Feed it back. Turn the real attack into your next simulation template. Nothing teaches faster than the message that actually fooled somebody.
Practically, that last step is where a phishing simulation programme earns its money. Your training stops being generic and starts reflecting what attackers genuinely send to your company. If ransomware is the worry, our guide to ransomware protection and recovery covers the containment side in more depth.
Frequently Asked Questions
How much does a phishing simulation cost in India?
Expect ₹250–900 per user per year for a managed programme, or ₹35,000–1.2 lakh for a single exercise. Smaller teams usually pay a flat minimum of around ₹30,000–50,000 a year.
How often should we run a phishing simulation?
Every four to eight weeks works best. Quarterly is acceptable. Annual testing produces a statistic rather than a behaviour change.
Should we tell employees the test is coming?
Tell them the programme exists. Do not announce individual campaigns. Announced tests measure attention on one day, not habits.
Is a phishing simulation legal in India?
Yes, when you test your own staff on your own systems with management approval. Additionally, state it in your security policy and treat the resulting data as employee personal data.
What is a good click rate?
Under 5% after a year of regular campaigns is strong. Baselines of 18–32% are common in Indian offices that have never tested before.
Does a phishing simulation help with ISO 27001 or DPDP?
Yes. Awareness training is an explicit control theme in ISO 27001, and our guide to the ISO 27001 certification cost in India explains where it fits. It also evidences reasonable safeguards under the DPDP Rules.
Can a phishing simulation replace email filtering?
No. Filtering, DMARC and multi-factor authentication remove most attacks. Simulation handles the ones that get through.
Running Your First Campaign
Novotron designs and runs phishing simulation programmes for businesses across Noida and Delhi NCR from our office at Aycon Tower, Sector 135, Noida. We handle campaign design, India-relevant templates, immediate training and the reporting your auditors ask for. To start with a baseline campaign, see our email phishing exercise services, browse more cyber security guides, or call +91-8130009878. You can also email sales@novotrontech.com.