AegisAI Perspectives · 075
Get written HR and legal consent plus an executive sponsor before any lure is written, keep AI research public, and never store a password anyone types.
Get written approval from HR and legal, plus a named executive sponsor, before any lure is written, because the NCSC says phishing simulations can create legal risk1. AegisAI runs this kind of test as a consented red team, where your security team scopes and approves every run18.
Ask HR first: the NCSC says you should always check with your HR department before undertaking any phishing simulations2. Bring legal into the design as well. NIST SP 800-50 Rev. 1 says the legal team should be included in the design and review of planned phishing exercises, partly to avoid using legitimate brands in the bait7.
California's standard sets protocols for coordinating phishing exercise plans with Human Resources and Legal departments5. It also requires written approval from the Information Security Officer or Chief Information Officer, plus a 72-hour advance notification email6.
Executives add one more signature: the CEO or board chair should sign the scope, because the lures will use their own public profile.
Write the no-punishment rule into the approval. NIST says these activities should not be punitive and no employee should be called out for their response8.
For executives, report results to the sponsor in aggregate, not by name in a leadership meeting. The NCSC also advises against reprimanding users who struggle to recognise phishing emails4.
Test with AI lures because attackers already use them. The FBI says criminals use AI-generated text to appear believable to a reader in spear phishing schemes11. In a study of 101 participants, fully AI-written spear phishing had a 54% click-through rate, the same as human experts, against 12% for the control group9.
In the same study, the AI-gathered information about targets was accurate and useful in 88% of cases10. An executive's public talks and press quotes give an AI that material, so a library template measures far less than a lure built from it.
Limit research to public sources and name them in the scope, such as company pages or press coverage. Exclude family members and home addresses in writing, along with private social accounts. Keep the bait away from real brands, as NIST advises for phishing exercises.
Never collect a credential. The landing page should record that a submit happened and discard whatever was typed. Agree a stop rule, a named person who can end the run at once, and a quiet period around earnings or board meetings.
Use the advanced delivery policy, not a mail flow rule that bypasses filtering for everyone. To configure a non-Microsoft phishing simulation there, you need at least one domain and at least one sending IP13. The policy takes up to 50 domain entries and up to 10 sending IP entries14.
Filters in Microsoft 365 take no action on messages the policy identifies16. Real attacks stay covered: Microsoft 365 doesn't allow allowlists or filtering bypass for messages identified as malware or high confidence phishing15. When an executive reports the test with the built-in Report button in Outlook, the system doesn't generate an alert, investigation, or incident17.
Tag the executives as priority accounts if you have not already. Microsoft lets an admin tag up to 250 high value users for extra heuristics and clearer reports12.
Get HR and legal sign-off on the purpose and scope, including the no-punishment rule.
Get the CEO or board chair to sign the list of executives and assistants in scope.
Write the research limits: public sources only, no family, no home address.
Name a stop owner and the quiet periods when nothing sends.
Review every lure before it sends, and drop any that uses a real brand.
Add the sending domain and IP to the advanced delivery policy.
Send on the agreed schedule, then show each executive the lesson page at once.
Report results to the sponsor in aggregate, with time to report as the main number.
| Control | Risk it removes | Who signs it |
|---|---|---|
| HR and legal approval | Legal claims and employee relations disputes | HR lead and counsel |
| Executive sponsor signature | A test that surprises the board or the CEO | CEO or board chair |
| Public sources only | Private data about an executive in a lure | Security lead |
| No credential kept | A real password stored by the test | Security lead |
| Advanced delivery policy | A bypass rule that also lets real phishing in | Email admin |
| Stop owner and quiet periods | A lure landing during earnings or a board vote | Security lead and sponsor |
Illustrative example, figures are fictional. A 2,000 person firm tests 12 executives and their 6 assistants after HR and counsel sign the scope with the CEO. The AI writes 30 lures from public talks and press quotes, and the security lead rejects 4 that name a real bank. Five executives click, one types a password that is never stored, and 9 people report the message within 10 minutes.
An AI agent researches each person and writes a lure just for them, the way attackers now work23. Research uses public sources only: web, LinkedIn, news and code search19. Nothing sends until the security team has read and approved it20. Your security team approves every step and can stop a run at any time22. No password is ever kept21.
Track three numbers per run, reported to the sponsor in aggregate.
It can be, with care. The NCSC says phishing simulations can create legal risk, so get HR and legal approval in writing first. California, for its own agencies, requires written approval from the security or IT chief.
Their sponsor should sign the scope, and HR should approve it. Most programs tell staff that exercises run at random, as NIST describes, rather than warning each person before a lure.
Yes, if the approval names them. Assistants handle executive mail and calendars, so a lure that reaches the executive often reaches them first. List them in the signed scope.
Add the sending domain and IP to the advanced delivery policy. Do not use a broad bypass rule. Microsoft never allows bypass for high confidence phishing, so real attacks stay filtered.
The test should not keep it. Record only that a submit happened, show the lesson page at once, and do not punish the person.
