The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Run the exercise as a controlled learning activity, not a covert test of individual employees. Use fictional identities and synthetic messages, send links to an isolated training page that cannot accept credentials, collect only the event data needed to assess reporting behavior, and delete raw records on a written schedule. Leadership, IT/security, and the privacy or legal lead should approve the scenario, telemetry, vendor terms, and stop conditions before anything is sent.
This design lets a nonprofit practise recognising and reporting phishing without touching donor, beneficiary, volunteer, payroll, health, immigration, case-management, or other operational records.
What a safe phishing awareness exercise is—and is not
A phishing awareness exercise sends a simulated suspicious message so staff can practise spotting warning signs and using the organisation’s reporting process. It should end in education, not in credential collection or disciplinary action. The exercise is successful when people know how to verify an unusual request, report it through the approved channel, and avoid entering information into an untrusted page.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchNIST describes simulated phishing as a way to prepare employees for real-world phishing and provides its Phish Scale to rate how difficult a message is for a person to detect. CISA recommends realistic simulations, clear reporting procedures, and recurring training. The Data Protection Commission (Ireland) identifies phishing and social engineering as routes to disclosure of sensitive information or malware installation. Those benefits do not justify collecting more personal data than the learning objective requires.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Boundaries to set before planning
- Do not use the exercise to rank, shame, or discipline employees. NIST SP 800-50 Rev. 1 (2024) says these activities should not be punitive and employees should not be called out for their response.
- Do not send simulated messages to beneficiaries, donors, external partners, or public mailboxes unless each audience has a separate approval and risk assessment.
- Do not impersonate a real bank, grant agency, regulator, partner, or other organisation without explicit approval. NIST warns that realistic bait can cause recipients to contact the impersonated organisation.
- Do not use real credentials, copied donor records, beneficiary details, case notes, payroll information, health or immigration data, or genuine sensitive attachments.
1. Define the learning objective, scope and stop conditions
Write a one-page exercise brief before drafting the email. It becomes the control document for the exercise and the basis for privacy review.
Specify what people should learn
Choose one or two observable behaviours, such as identifying an unexpected invoice request, checking a link destination, reporting a suspicious message through the reporting button, or verifying an unusual request through a known contact method. Avoid a vague goal such as “test security.” A precise objective determines which events you need to count and which data you can leave uncollected.
Record operational boundaries
- Target group and exclusions, including privileged accounts, shared mailboxes, on-call addresses, and anyone who must be excluded for safety or accessibility reasons.
- Approved sending domain, campaign dates and time zone, message volume, and the systems in scope.
- Owner, technical operator, privacy or legal reviewer, incident contact, and person authorised to stop the exercise.
- Success measures, retention period, deletion method, and the conditions that trigger an immediate kill switch.
Typical stop conditions include a real recipient reporting harm, a message reaching an unapproved audience, a link behaving differently from the tested version, evidence that a real credential was requested, or a vendor retaining data outside the approved terms.
Make the exercise non-punitive
Tell staff in advance that the organisation runs randomised awareness exercises, while keeping the exact timing and scenario unpredictable. Advance notice establishes transparency without removing the learning value. State that results are for improving training and reporting processes, not performance appraisal. A manager should never receive an individual score for disciplinary use.
2. Obtain governance, privacy and legal approval
Approval is part of the security control, not an administrative afterthought. NIST SP 800-50 Rev. 1 specifically recommends including the legal team in the design and review of planned phishing exercises.
Review these items before sending
- The purpose, lawful basis where applicable, target population, exclusions, dates, and stop conditions.
- The exact sender identity, message text, links, attachments, redirect behaviour, and training-page wording.
- All telemetry: delivery, opens if used, clicks, attempted submissions, reports, timestamps, IP addresses, user identifiers, and administrator logs.
- The landing-page hosting location, access controls, encryption, processor or vendor contract, subprocessors, breach-notification terms, and deletion settings.
- The reporting channel and the response plan if someone forwards the simulation, replies to it, or reports a real incident at the same time.
The ICO’s worker-monitoring guidance requires a clear purpose, data minimisation, security, transparency, and retention limits. Document why each field is necessary. If a field cannot change a training decision, remove it.
Define who can see results
Use least-privilege access. Aggregate results should be available to the training owner and leadership in a form that cannot identify an individual. If individual follow-up is genuinely necessary, place the pseudonymised list in a restricted location, log access, and set a short deletion date. Do not publish leaderboards or name people in reports.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Build synthetic messages and identities
Write the entire scenario from fictional material. A synthetic message can still contain realistic warning signs without exposing operational information.
Safe content examples
- A fictional “Community Learning Fund” asks for confirmation of a made-up grant reference.
- A fabricated supplier sends an invoice number that has no relationship to a real supplier or purchase.
- A fictional internal notice points to a training document on an approved exercise domain.
Use invented names, domains, account numbers, dates, donation appeals, grant notices, and invoice references. Keep logos and wording generic unless the organisation has explicitly approved a brand-neutral design. Do not copy a real donor appeal, beneficiary story, volunteer roster, payroll message, health appointment, immigration case, or partner communication.
Keep the difficulty intentional
Rate each message with the NIST Phish Scale so that results are interpreted in context. A highly convincing message and an obvious one should not be treated as equivalent tests. Record the cues that make the message difficult—such as urgency, unusual sender domain, unexpected attachment, or request for secrecy—and use those cues in the debrief.
4. Isolate the landing page from production data
The safest click target is a training-only page on an approved exercise domain. It should explain the simulation and the correct reporting action; it should not authenticate the visitor or process a form.
Required technical properties
- Every button terminates at an education page. There is no route to a login screen, payment form, case-management system, donor database, shared drive, or production application.
- The page accepts no passwords, one-time codes, names, email addresses, free-text fields, uploaded files, address-book data, message bodies, screenshots, or keystrokes.
- Disable form submission and remove scripts that collect unnecessary browser or device details.
- If a click identifier is needed, generate a random, single-purpose token that cannot be reused for authentication and cannot reveal a person’s identity to the page.
- Use a training domain approved by IT/security and verify certificate, DNS, mail routing, redirects, and allow-listing before the pilot.
An attempted submission can be counted as an event without retaining what a participant typed. Configure the endpoint to discard the request body immediately and store only a counter or pseudonymous event token.
Protect the message and logs
Do not place real addresses, case references, or sensitive text in URLs, subject lines, attachment metadata, analytics labels, or error logs. Restrict administrative logs to the people operating the exercise, encrypt them in transit and at rest, and disable vendor features that create recordings, session replays, screenshots, or keystroke histories.
5. Minimise telemetry to the events you can act on
Start with aggregate counts. A small nonprofit usually needs to know how many messages were delivered, clicked, reported, or associated with an attempted submission—not the contents of anyone’s interaction.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
| Event | What it can tell you | Privacy-preserving implementation |
|---|---|---|
| Delivery | Whether mail routing and allow-listing worked | Store a campaign total; avoid retaining full recipient lists after reconciliation |
| Click | Whether the warning cues and reporting process need reinforcement | Count clicks or use a random non-authentication token; do not capture browser profiles |
| Attempted submission | Whether a participant tried to provide information | Record only that an attempt occurred; discard every submitted value and request body |
| Report | Whether staff used the approved reporting channel | Count reports and timestamps; do not retain message bodies unless needed to handle a real incident |
| Median time to report | How quickly the process worked after delivery | Use event timestamps with the shortest precision that supports the decision |
Opens are often unreliable because mail clients prefetch tracking pixels. If an open count cannot change a training decision, omit it. IP addresses, exact user agents, and persistent identifiers should not be collected by default.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When individual follow-up is necessary
Individual data may be justified for immediate coaching or accessibility support, but it should be exceptional. Pseudonymise the export, keep the re-identification key separate, limit access to the small training team, and set a deletion deadline before launch. Never convert a follow-up list into a permanent employee-risk profile.
6. Give staff a clear reporting route
The exercise should teach one known action. Provide a reporting button in the mail client or a designated mailbox, and explain how to use it before the campaign begins. CISA advises verifying unusual requests through a known contact method rather than replying to the suspicious message, then reporting and deleting suspected phishing.
Include these instructions in the training page
- Do not reply, click further, download an attachment, or enter information.
- Use the organisation’s approved report-phishing button or mailbox.
- If the message asks for money, access, or a sensitive action, verify it through a known telephone number or previously trusted channel—not contact details in the message.
- Delete the message after reporting, unless the security team asks you to preserve it for investigation.
Make the reporting channel usable from mobile devices and shared workstations. Tell staff how to report a real suspicious message during the simulation so a genuine incident is not mistaken for the exercise.
7. Pilot the exercise with designated accounts
Run a small pilot before the campaign. Use internal test accounts owned by the exercise team, not real donors, beneficiaries, external partners, or public mailboxes.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Send the synthetic message to the designated accounts and confirm the sender identity, authentication records, subject line, links, attachment handling, and formatting.
- Verify that approved mail filters deliver the message and that allow-listing does not weaken protection for other senders.
- Click every link and activate every button from a safe test account. Confirm that each route reaches education and that no credential, form field, upload, screenshot, or keystroke is stored.
- Test the report-phishing button and mailbox. Confirm that a report is counted without retaining unnecessary message content.
- Check dashboards, access permissions, audit logs, retention settings, export files, backups, and vendor deletion controls.
- Exercise the kill switch: stop delivery, disable redirects, revoke tokens, and notify the incident contact. Record how long each action takes.
Do not proceed until the pilot owner can demonstrate that a mistyped password would be discarded rather than stored. The safest design makes it impossible for the landing page to receive a password in the first place.
8. Send, monitor and stop safely
Send within the approved window and monitor only the operational signals needed to keep the exercise safe: delivery failures, unexpected audiences, report volume, landing-page errors, and security alerts. Do not inspect individual behaviour while the campaign is running unless the approved follow-up plan requires it.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Immediate stop triggers
- A recipient reports a real privacy, safeguarding, accessibility, or wellbeing concern.
- The message reaches an excluded address or an external organisation.
- A redirect, attachment, or page behaves differently from the pilot.
- Any credential, uploaded file, production record, or sensitive message content appears in telemetry.
- The vendor cannot confirm its processor, access, location, or deletion controls.
After a stop, preserve only the minimal incident evidence required by the response plan, disable the campaign, and notify the designated security and privacy contacts. Do not continue sending while the cause is uncertain.
9. Debrief immediately and support participants
Redirect anyone who clicks to a short explanation of the cues they missed and the reporting action to take. The page should be respectful and useful, not a “gotcha.” Explain that no credentials were requested or stored, identify the fictional nature of the scenario, and provide the real reporting route.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA practical debrief contains
- The warning signs in the message, tied to the NIST Phish Scale difficulty rating.
- The verification method for unusual requests, including a known contact route.
- The report-and-delete procedure and what to do if a real message looks similar.
- A contact for questions, accessibility concerns, or confidential support.
Offer supportive remediation such as a short refresher or optional coaching. Do not publish leaderboards, email individual results to managers, or describe a person as careless. The purpose is to improve future decisions and the reporting system.
10. Measure behaviour without inventing a “safe” click rate
NIST identifies click-through and report measurements as common exercise metrics, but it does not establish a universal safe click-rate target. Compare your own trend data by message difficulty, audience context, and reporting opportunity rather than treating one percentage as a pass or fail.
| Metric | Calculation | Interpretation |
|---|---|---|
| Delivery rate | Delivered messages divided by intended recipients | Shows campaign reach and mail-routing problems, not employee awareness |
| Click rate | Recorded clicks divided by delivered messages | Interpret only with message difficulty, context, and the available reporting route |
| Attempted submission rate | Submission attempts divided by delivered messages | Count attempts without retaining submitted values |
| Report rate | Reports divided by delivered messages | Shows whether people used the approved channel; check for duplicate reports |
| Median time to report | Median interval between delivery and report | Shows speed of detection and whether the process is practical |
Review trends across exercises, not isolated individuals. A lower click rate may reflect an easier message, a different audience, or a more visible report button. Record those contextual changes so the next comparison is fair.
NISTIR 8420A (2021) reported that just over 85% of surveyed participant organisations performed some type of phishing simulation. That is a finding about that survey population, not a benchmark or target for nonprofits.
Recommended Free Tools
11. Delete raw data on a documented schedule
Retention is part of the design. Write the deletion date before launch and assign an owner who must verify completion.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Delete or minimise
- Individual click, report, and attempted-submission events after aggregate results and approved follow-up are complete.
- Temporary recipient lists and campaign exports after delivery reconciliation.
- Message copies, attachment files, redirect tokens, and landing-page logs that are no longer needed.
- Vendor-held records, backups, analytics events, and support tickets according to the processor agreement.
Retain only an aggregate result, the exercise objective, lessons learned, approval record, and evidence that deletion occurred. If an exception is required for a security incident or legal obligation, document the reason, data held, custodian, and revised deletion date.
In-house exercise or vendor platform?
Either approach can be safe. The deciding factor is control over data and failure modes, not whether the tooling is commercial or built internally.
| Decision axis | Questions to ask |
|---|---|
| Credential-capture prevention | Can the platform technically prevent passwords and form values from being accepted, logged, or replayed? |
| Synthetic-content controls | Can administrators use fictional identities and generic scenarios without importing production contacts or message content? |
| Reporting granularity | Can the default view be aggregate, with individual follow-up disabled or tightly restricted? |
| Data location and processor terms | Where are telemetry and backups stored, which subprocessors are involved, and does the contract define security, breach notification, and deletion? |
| Retention and deletion | Can you set a short retention period, delete exports and backups, and obtain deletion evidence? |
| Access logging | Are administrator access and exports logged, and can least-privilege roles be enforced? |
| Allow-list and kill switch | Can the team test mail routing safely and stop delivery or redirects immediately? |
| Reporting-channel integration | Does the exercise reinforce the organisation’s existing report-phishing button or mailbox rather than create a second process? |
| Administrative effort | Who maintains domains, content, approvals, monitoring, debriefs, and deletion evidence? |
An in-house design may give tighter control over storage and customisation but requires staff to build safe landing pages, logging, access controls, and deletion automation. A vendor may reduce administration, but the privacy or legal review must cover processor terms, data location, subprocessors, default telemetry, and contractual deletion.
Common failure modes and fixes
“We will collect passwords only for testing”
Do not. A training page should not accept credentials at all. Replace the form with an education page and count only an attempted submission event, discarding the request body.
“Managers need a list of people who clicked”
Start with aggregate results. If coaching is necessary, give the restricted training team a pseudonymised, short-lived list and prohibit use for appraisal or discipline.
“A realistic bank or grant-agency message will make the test better”
It can cause recipients to contact the real organisation or trigger safeguarding concerns. Use a fictional entity and synthetic references, or obtain explicit approval for any exceptional impersonation.
“We can keep the logs in case they are useful later”
That conflicts with data minimisation and retention limits. Define the decision the log supports, aggregate it, and delete event-level records by the stated deadline.
“A high click rate proves the programme failed”
It does not, by itself. Interpret clicks alongside NIST Phish Scale difficulty, audience context, reporting access, and prior training. Use the trend to improve the message, process, or coaching—not to label people.
Quick Recap
Final launch checklist
- Purpose, scope, owner, dates, success measures, retention period, and stop conditions are written.
- Leadership, IT/security, and privacy or legal reviewers have approved the scenario and data flows.
- Staff have advance notice that randomised exercises occur and understand the non-punitive purpose.
- All identities, links, attachments, and records are synthetic; no real credentials or sensitive data are used.
- The landing page is on an approved training domain, accepts no credentials or uploads, and has been tested with a kill switch.
- Telemetry is limited to delivery, click, attempted-submission, report, and timing events that support a stated decision.
- Individual access is least-privilege and pseudonymised; leaderboards and disciplinary use are prohibited.
- The report-phishing route is known, tested, and reinforced in the debrief.
- Vendor processor terms, security controls, data location, access logging, retention, and deletion are verified.
- Aggregate results, lessons, approvals, and deletion evidence will remain after raw event data is removed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
