Phishing Simulation for Schools: How to Run It and Which Tools Fit

Best Phishing Simulation Tools for K-12 Schools

For most schools, the best fit is a platform built for K-12: templates from the services your staff use, simulations that are safe for students, and a price per school.

Free and Built-In Tools

• Gophish is a free, open-source phishing framework. You host it, write the emails, and build any training yourself. It suits an IT team with time to spare.
• KnowBe4's free attack simulation test gives you a baseline before you buy anything.
• Microsoft Attack Simulation Training is part of Microsoft Defender, and you only have it if your school's Microsoft 365 license includes it.

Corporate Platforms Priced per User

Most security awareness platforms, KnowBe4 included, are built for businesses and charge per user. If you're weighing KnowBe4, our Tartan App and KnowBe4 comparison covers the school view.

Platforms Built for K-12 Schools

A few vendors build only for schools, including Tartan, CyberNut, and SecureSchools. Tartan and SecureSchools both publish annual prices for a single school. Tartan's phishing simulations include templates for 110+ services staff use every day, like PowerSchool, Skyward, and Google Classroom.

Microsoft Attack Simulation Training and Google Workspace: What Schools Need

Email filters exist to stop phishing, so they can block or flag your practice emails too. Plan for delivery before your first send.

In Microsoft 365, the advanced delivery policy lets non-Microsoft phishing simulations reach inboxes without filtering. Microsoft's own Attack Simulation Training needs a Microsoft 365 E5 or Defender for Office 365 Plan 2 license.

Tartan delivers simulations straight into Google Workspace or Microsoft 365 inboxes. You can also use Microsoft advanced delivery or domain allowlisting. Whichever you use, simulations arrive in Gmail and Outlook looking like the vendor emails staff trust.

Phishing Simulation Pricing for Schools: Per School or Per User

Per-user pricing grows with every staff member you train. Across the 37 vendors with per-user prices in Tartan's security awareness training pricing guide, the median is $24.96 per user a year. At that price, a school with 60 staff pays about $1,498 a year. Tartan prices per school, with unlimited staff for public districts and Canadian school boards. For one school, employee phishing simulations cost $116 a year and employee video training costs $30. See Tartan pricing for 1 to 10 schools.

Phishing Simulation Metrics: What NIST and the Research Say

The strongest sign that a phishing program works is how often staff report a suspicious email. An ETH Zurich study, published in 2022, followed more than 14,000 employees for 15 months and found that reporting worked. Staff reported new phishing campaigns fast, kept reporting over time, and the IT workload stayed manageable.

NIST's guide to security learning programs, SP 800-50 Revision 1, lists "reported a suspected phishing email" as a measure of behavior change. A rising report rate means the habit is growing.

Our take: training after a click works best when it is short and built on the email someone just clicked. In Tartan, staff who click see that email with 2 to 4 numbered clues that gave it away.

Phishing Report Buttons for Gmail and Outlook

A report button makes reporting one click. NIST notes that some organizations add one to encourage best practices. Staff use the same button for practice emails and real ones.

Tartan App Shield adds a report button to Gmail and Outlook. Staff report without forwarding anything or opening a ticket. They get an email back saying whether the message was safe or a threat. Staff also earn points for reporting, and leaderboards rank schools and departments.

In their first eight weeks with Tartan, Monroe School District staff reported 97 suspicious emails. Tartan's AI flagged 75 of them as malicious or suspicious.

Running Phishing Simulations with a Small School IT Team

Six steps keep the program fair, and light enough for a small IT team to run.

1. 1
   Tell staff first. NIST advises telling employees that exercises happen at random and that results guide future learning. Send a short note before the first email. You're done when every staff member has it.
2. 2
   Bring in HR or legal. NIST says the legal team should help design and review phishing exercises. If your staff have a union, we recommend sharing the plan with them too.
3. 3
   Set a baseline. Send one simulation to everyone and record click and report rates by school or role. NIST suggests starting with click rates by group or work role.
4. 4
   Use emails your staff really get. Student information system alerts, payroll notices, and a message from a leader are the realistic ones. Tartan can impersonate a superintendent or colleague at easy, medium, or high difficulty.
5. 5
   Plan around the school calendar. We recommend skipping the first week back, testing weeks, and report-card deadlines. Staff are busiest then, and a practice email feels like a trick.
6. 6
   Never name or punish anyone. NIST says these exercises "should not be punitive, nor should any employee be called out for their response". Share results by school or group.

A note to staff can be this short:

This year we're running practice phishing emails. They arrive at random times and look like real messages. If one looks off, click Report. No one is named or in trouble for clicking. We use the results to plan training.

Phishing Simulations for Students

Students use school email too, so many schools train them as well. Keep student simulations separate from staff ones and suited to their age.

Tartan's student simulations run on their own schedule, separate from staff. They're part of Student Phishing & Video Training, which is priced separately. Fake login page tests store nothing a person types. Tartan has signed the Student Data Privacy Consortium's National Data Privacy Agreement, and its privacy policy addresses FERPA and COPPA. We also recommend telling families before student simulations start.

Phishing Simulation Compliance for K-12 Schools

Training rules and insurance questions push schools toward phishing simulations.

• Texas: only the district's cybersecurity coordinator must complete certified cybersecurity training each year. Any other employee required to train does so as the district determines. Tartan's training program is certified by Texas Cyber Command (TXCC) for 2026–2027.
• Cyber insurance: typical insurance applications ask, "Does the Applicant conduct email phishing simulations?"
• CISA: its 2023 report on K-12 cybersecurity recommends a strong cybersecurity training program. It also asks whether front-line staff know how to report something suspicious.