Phishing simulation results

Detects phishing simulation result exports: simulation-result wording with per-user outcome rows (email plus clicked/submitted/reported) and numeric campaign metrics. Discussions of phishing simulations are discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a per-user outcome row (email address with clicked/submitted/reported/no action) or a campaign metric with a number (click/report/submission rate, emails sent, recipients)), and 85 needs two distinct structures plus independent campaign-follow-up (remedial training, repeat clicker, lure, department/manager) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), GDPR
Frameworks: ISO 27001, NIST CSF
Data categories: security, pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:phishing\s+(?:simulation|campaign|test|exercise)\s+(?:results?|report|export|summary)|simulated\s+phishing\s+(?:campaign|results?|report)|(?:KnowBe4|Gophish|Cofense\s+PhishMe|Attack\s+Simulation\s+Training)\s+(?:results?|report|export|campaign))\b

Corroborative evidence keywords

remedial training, repeat clicker, landing page, lure, department, manager, payload, sender spoof, business unit, follow-up

Proximity: 300 characters

Should match

The quarterly phishing simulation results will be presented to the audit committee. — Discovery probe (65)
Phishing simulation results - September campaign Emails sent: 1240 Click rate: 7.4% — Medium-tier probe (75) - numeric campaign metrics
Phishing simulation results - "Payroll update" lure Emails delivered: 1240; click rate: 7.4% avery.teston@harbourhealth.org.au, Finance, clicked jordan.staffson@harbourhealth.org.au, Payroll, submitted credentials riley.marsh@harbourhealth.org.au, ICT, reported Repeat clicker list forwarded to each department manager for remedial training. — High-tier probe (85) - per-user outcome rows, metrics and follow-up context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: all staff complete a phishing simulation exercise each quarter; results are reported in aggregate. — Policy text
Phishing simulation results template Email: ________ Outcome: [insert] — Blank template
Media release: industry phishing test report finds the average click rate fell to 4.1% this year. — News framing with an aggregate metric

Known false positives

Vendor reports publish aggregate industry click rates. Mitigation: Aggregate metrics alone reach 75 only with result wording; news/press framing is excluded and 85 needs per-user rows.