Automated phishing training uses GoPhish (free, open-source) and n8n to send simulated phishing emails to your team on a recurring schedule, track who clicks, automatically enroll clickers in training, and generate resilience reports over time. The entire stack is self-hosted, costs nothing beyond setup, and takes about two hours to deploy. Organizations running quarterly phishing simulations see click rates drop from 30-40 percent to under 5 percent within a year.

Your employee just clicked a link in an email that said their Netflix account was suspended. The email came from “netfIix.com” — that is a capital I instead of an L, but who looks that closely? The link took them to a page that looked exactly like Netflix, they typed in their password, and because they use the same password for everything (we talked about this), the attacker now has the credentials for their work email too.

This is not a hypothetical scenario. This is Tuesday. Phishing is the initial attack vector in the majority of small business breaches, and it works not because your employees are careless or unintelligent — it works because phishing emails in 2026 are genuinely sophisticated. AI-generated content, perfect grammar, spoofed sender addresses, and urgency triggers that bypass rational thinking.

Phishing training automation uses tools like GoPhish (an open-source phishing simulation platform) and n8n (an open-source workflow automation tool) to send simulated phishing emails to your team on a recurring schedule, track who clicks, automatically enroll clickers in training, and generate reports showing your team’s resilience over time. The entire stack is free, self-hosted, and takes about two hours to set up. After that, your phishing training program runs itself — every quarter, automatically, with zero per-email costs.

Here is exactly how to build it. Every step is real, every configuration is tested, and you will have a working phishing simulation program by the end of this guide.

Why Annual Training Videos Do Not Work

Let me get something out of the way. If your current phishing training consists of a once-a-year video that employees click through while checking their phones, you do not have phishing training. You have a compliance checkbox that provides approximately zero behavioral change.

Here is what the research shows: security awareness training that consists of annual presentations or videos produces no measurable reduction in phishing click rates after 90 days. The information fades. The skills atrophy. And by month four, your team is clicking phishing links at the same rate as before the training.

What does work is simulated phishing combined with immediate feedback. When an employee clicks a simulated phishing link and immediately sees a page that says “This was a test. Here is what you should have noticed,” that moment of “oh no” creates a learning experience that sticks. The embarrassment (kept private, not public shaming) creates a neural pathway that activates the next time a suspicious email arrives.

The data backs this up consistently. Organizations that run quarterly phishing simulations see click rates drop from 30-40% on the first test to under 5% within a year. That is a dramatic, measurable improvement in your human firewall — and it costs nothing beyond the initial setup time.

The Architecture: GoPhish + n8n + Tracking Dashboard

Here is what we are building:

GoPhish handles the phishing simulation itself. It sends the fake phishing emails, hosts the fake landing pages, and tracks who opens the email, who clicks the link, and who enters credentials on the fake page. GoPhish is free, open-source, and purpose-built for this.

n8n orchestrates everything around GoPhish. It schedules campaigns to launch automatically, pulls results from GoPhish’s API, sends training notifications to employees who clicked, generates summary reports for management, and stores historical data so you can track improvement over time.

Google Sheets (or any spreadsheet) serves as your tracking dashboard. n8n pushes results to a sheet after each campaign, giving you a visual record of click rates, repeat offenders, and overall team improvement.

The data flow looks like this:

n8n triggers a scheduled workflow (quarterly or monthly)
n8n calls the GoPhish API to launch a pre-configured campaign
GoPhish sends phishing simulation emails to your team
Employees interact with the emails (open, click, submit data)
n8n polls GoPhish for campaign results after a set period
n8n processes results: identifies clickers, calculates rates
n8n sends training reminder emails to employees who clicked
n8n pushes campaign summary to Google Sheets dashboard
n8n sends a management report via email or Slack

Step 1: Install and Configure GoPhish

GoPhish runs as a standalone binary. No complex dependencies, no Docker required (though Docker works too). Download it from the official GitHub releases page. For a deeper look at this topic, see our guide on MFA for Every Employee: A Step-by-Step Setup Guide (M365 and Google).

For Windows:

# Download GoPhish (check github.com/gophish/gophish/releases for latest version)
# As of March 2026, v0.12.1 is the latest release

# Create directory
New-Item -Path "C:\GoPhish" -ItemType Directory -Force

# Download and extract (using browser or PowerShell)
Invoke-WebRequest -Uri "https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-windows-64bit.zip" `
    -OutFile "C:\GoPhish\gophish.zip"

Expand-Archive -Path "C:\GoPhish\gophish.zip" -DestinationPath "C:\GoPhish" -Force

# Edit config.json before first run
# Change admin_server listen_url to "0.0.0.0:3333" for network access
# Change phish_server listen_url to "0.0.0.0:8080"

For Linux/Mac:

# Download and extract
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip -d /opt/gophish
chmod +x /opt/gophish/gophish

Before you run GoPhish for the first time, edit config.json:

{
  "admin_server": {
    "listen_url": "0.0.0.0:3333",
    "use_tls": true,
    "cert_path": "gophish_admin.crt",
    "key_path": "gophish_admin.key"
  },
  "phish_server": {
    "listen_url": "0.0.0.0:8080",
    "use_tls": false,
    "cert_path": "",
    "key_path": ""
  },
  "db_name": "sqlite3",
  "db_path": "gophish.db",
  "migrations_prefix": "db/db_",
  "contact_address": "",
  "logging": {
    "filename": "gophish.log",
    "level": ""
  }
}

Start GoPhish:

cd C:\GoPhish
.\gophish.exe

# Output will show the temporary admin password:
# time="2026-03-19" level=info msg="Please login with the username admin and the password XXXXXXXX"

Navigate to https://localhost:3333, log in with admin and the temporary password, and change your password immediately.

Step 2: Configure GoPhish Campaign Templates

Before n8n can automate campaigns, you need to set up the building blocks in GoPhish’s web interface.

Sending Profile. This configures how GoPhish sends emails. You need an SMTP server. Options:

Your business email server (if you have one)
A dedicated sending service like Amazon SES ($0.10 per 1,000 emails)
A free Gmail account configured for SMTP (for small teams under 20)

In GoPhish, go to Sending Profiles > New Profile:

Name: “Phishing Sim Sender”
SMTP From: [email protected]
Host: smtp.gmail.com:587 (for Gmail) or your SMTP server
Username/Password: your SMTP credentials
Check “Ignore Certificate Errors” if using a self-signed cert

Email Template. Go to Email Templates > New Template. Here is a realistic template that mimics a common phishing pattern:

Name: “Password Expiry Notice”
Subject: Action Required: Your password expires in 24 hours
In the HTML editor, create a professional-looking email that says:

<html>
  <body
    style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;"
  >
    <div style="background: #f5f5f5; padding: 20px; text-align: center;">
      <h2 style="color: #333;">IT Security Notice</h2>
    </div>
    <div style="padding: 20px;">
      <p>Hello {{.FirstName}},</p>
      <p>
        Your network password is set to expire in <strong>24 hours</strong>. To
        avoid being locked out of your accounts, please update your password now
        using the secure link below.
      </p>
      <div style="text-align: center; margin: 30px 0;">
        <a
          href="{{.URL}}"
          style="background: #0066cc; color: white;
           padding: 12px 24px; text-decoration: none; border-radius: 4px;
           font-size: 16px;"
          >Update Password Now</a
        >
      </div>
      <p style="color: #666; font-size: 12px;">
        This is an automated message from the IT department. If you have
        questions, contact the help desk.
      </p>
    </div>
  </body>
</html>

Landing Page. Go to Landing Pages > New Page. Create a page that looks like a password change form:

Name: “Password Change Sim”
Check “Capture Submitted Data”
Check “Capture Passwords” (for tracking only — GoPhish does not store actual passwords in cleartext by default)
Check “Redirect to” and enter a training page URL

The redirect URL is critical. When an employee submits credentials on the fake page, they immediately see a training page that explains: “This was a phishing simulation. Here is what you should have noticed…” This immediate feedback is what makes the training effective.

Users and Groups. Go to Users & Groups > New Group. Import your employee list as a CSV with columns: First Name, Last Name, Email, Position.

Step 3: The n8n Automation Workflow

Now we connect everything with n8n. If you do not have n8n installed, the fastest way is:

# Install via npm (Node.js 18+ required)
npm install -g n8n

# Or run via Docker
docker run -d --name n8n -p 5678:5678 \
  -v n8n_data:/home/node/.n8n \
  n8nio/n8n

Access n8n at https://automateanddeploy.com:5678. Here is the complete workflow configuration. In n8n, create a new workflow and add these nodes:

Node 1: Schedule Trigger

Type: Schedule Trigger
Interval: set to your desired frequency (quarterly = every 90 days, monthly = every 30 days)
Time: set to a Tuesday at 10:00 AM (mid-week, mid-morning gets the most realistic engagement)

Node 2: Launch GoPhish Campaign (HTTP Request)

Type: HTTP Request
Method: POST
URL: https://YOUR_GOPHISH_SERVER:3333/api/campaigns/
Authentication: Header Auth
Header Name: Authorization
Header Value: Bearer YOUR_GOPHISH_API_KEY (find this in GoPhish Settings)
Body (JSON):

{
  "name": "Quarterly Phishing Sim - {{ $now.format('yyyy-MM') }}",
  "template": { "name": "Password Expiry Notice" },
  "page": { "name": "Password Change Sim" },
  "smtp": { "name": "Phishing Sim Sender" },
  "groups": [{ "name": "All Employees" }],
  "launch_date": "{{ $now.toISO() }}",
  "send_by_date": "{{ $now.plus({ hours: 4 }).toISO() }}"
}

Node 3: Wait Node

Type: Wait
Duration: 72 hours (give employees 3 business days to interact with the email)

Node 4: Fetch Campaign Results (HTTP Request)

Type: HTTP Request
Method: GET
URL: https://YOUR_GOPHISH_SERVER:3333/api/campaigns/{{ $json.id }}/results
Authentication: same Bearer token as Node 2

Node 5: Process Results (Code Node)

Type: Code
Language: JavaScript

// Process GoPhish campaign results
const results = $input.first().json;
const timeline = results.timeline || [];
const targets = results.results || [];

let emailsSent = 0;
let emailsOpened = 0;
let linksClicked = 0;
let dataSubmitted = 0;
const clickers = [];
const submitters = [];

for (const target of targets) {
  emailsSent++;
  if (
    target.status === "Email Opened" ||
    target.status === "Clicked Link" ||
    target.status === "Submitted Data"
  ) {
    emailsOpened++;
  }
  if (target.status === "Clicked Link" || target.status === "Submitted Data") {
    linksClicked++;
    clickers.push({
      name: `${target.first_name} ${target.last_name}`,
      email: target.email,
      action: target.status,
    });
  }
  if (target.status === "Submitted Data") {
    dataSubmitted++;
    submitters.push({
      name: `${target.first_name} ${target.last_name}`,
      email: target.email,
    });
  }
}

const clickRate =
  emailsSent > 0 ? ((linksClicked / emailsSent) * 100).toFixed(1) : 0;
const submitRate =
  emailsSent > 0 ? ((dataSubmitted / emailsSent) * 100).toFixed(1) : 0;

return [
  {
    json: {
      campaign_name: results.name,
      date: new Date().toISOString().split("T")[0],
      emails_sent: emailsSent,
      emails_opened: emailsOpened,
      links_clicked: linksClicked,
      data_submitted: dataSubmitted,
      click_rate: `${clickRate}%`,
      submit_rate: `${submitRate}%`,
      clickers: clickers,
      submitters: submitters,
    },
  },
];

Node 6: Send Training Emails to Clickers (Email Send / Loop)

Type: Split In Batches (loop over clickers array)
Connected to: Send Email node
Email Subject: “Security Training: What to Look For”
Email Body: A brief, non-punitive message explaining what the phishing simulation tested and linking to a training resource

Node 7: Update Google Sheets Dashboard

Type: Google Sheets (Append Row)
Spreadsheet: “Phishing Simulation Tracker”
Sheet: “Campaign Results”
Columns: Date, Campaign Name, Emails Sent, Links Clicked, Click Rate, Data Submitted, Submit Rate

Node 8: Send Management Report (Email)

Type: Send Email
To: your management distribution list
Subject: Phishing Simulation Report - {{ $json.date }}
Body template:

Phishing Simulation Report
==========================
Campaign: {{ $json.campaign_name }}
Date: {{ $json.date }}

Results:
- Emails Sent: {{ $json.emails_sent }}
- Emails Opened: {{ $json.emails_opened }}
- Links Clicked: {{ $json.links_clicked }} ({{ $json.click_rate }})
- Credentials Submitted: {{ $json.data_submitted }} ({{ $json.submit_rate }})

Employees who clicked have been sent training reminders.
See the full dashboard in the shared Google Sheet.

Step 4: Building Your Phishing Template Library

One template is not enough. Attackers use diverse tactics, and your simulations should mirror that diversity. Here are five template categories to rotate through:

Category 1: Credential harvesting. “Your password is expiring” or “Verify your account” emails that redirect to a fake login page. This is the most common real-world phishing pattern.

Category 2: Urgency-based. “Your account will be suspended” or “Unauthorized login detected — click here immediately.” These exploit fear and time pressure.

Category 3: Authority-based. An email that appears to come from the CEO or a senior manager asking for urgent action. “I need you to process this wire transfer before end of day.” Business email compromise costs businesses billions annually.

Category 4: Curiosity-based. “You received a package” or “Someone shared a document with you” or “Your performance review is ready.” These exploit natural curiosity.

Category 5: Seasonal and topical. Tax season emails, holiday party RSVPs, benefits enrollment notices. These feel timely and legitimate, which makes them more effective.

Create at least two templates in each category. That gives you ten templates, enough for two and a half years of quarterly rotations without repeating. In GoPhish, set up each template with appropriate subject lines, realistic HTML formatting, and matching landing pages.

Step 5: The Tracking Dashboard

Your Google Sheets dashboard tracks results over time. Create a spreadsheet with these tabs:

Tab 1: Campaign Results — One row per campaign with columns: Date, Campaign Name, Template Category, Emails Sent, Opened, Clicked, Submitted, Click Rate, Submit Rate.

Tab 2: Individual Tracking — One row per employee per campaign with columns: Employee Name, Email, Campaign Date, Opened (Y/N), Clicked (Y/N), Submitted (Y/N), Training Sent (Y/N), Training Completed (Y/N).

Tab 3: Trend Chart — A line chart showing click rate over time. This is your board-ready metric that proves the training program is working.

Tab 4: Repeat Clickers — Employees who have clicked in two or more simulations. These individuals need additional one-on-one training or, if the pattern continues, a conversation about their access to sensitive systems.

After three or four campaigns, you will see a clear downward trend in click rates. That trend is your proof of ROI. Show it to your team, your leadership, and your insurance company. We cover this in more detail in VPN Setup for Remote Teams: A Plain-English Guide for Business Owners.

Running Your First Campaign

Before you unleash the automation, run your first campaign manually to calibrate expectations and catch any configuration issues.

In GoPhish, create a new campaign using one of your templates.
Start with a small test group — yourself and two or three trusted colleagues. Verify that emails arrive, links work, and the landing page displays correctly.
Once verified, launch to your full team.
Wait 72 hours for results.
Review the results in GoPhish’s dashboard.
Send training follow-ups manually to anyone who clicked.
Record results in your Google Sheet.
Share a brief, team-wide summary (without naming individuals who clicked).

After this manual run succeeds, activate the n8n automation. Future campaigns will run on schedule with no manual intervention required.

Handling Results Without Creating a Blame Culture

This is critical and I need to emphasize it: phishing simulations are training tools, not punishment tools. The moment employees feel like they are being tricked and shamed, they will stop reporting real phishing attempts for fear of “getting in trouble.” That is the opposite of what you want.

Do: Keep individual results private between the employee and their manager. Send training reminders that are helpful, not punitive. Celebrate team-wide improvement. Acknowledge that sophisticated phishing is designed to fool smart people.

Do not: Post a “wall of shame” with names of people who clicked. Publicly embarrass anyone. Use simulation results in performance reviews. Fire someone for clicking a simulated phish (unless it is a pattern combined with refusal to improve).

Do: Create a culture where reporting suspicious emails is praised. If someone says “I got a weird email and I was not sure, so I reported it,” that person is your security hero for the day. Make it easy to report — a dedicated “Report Phishing” button in the email client or a simple email to [email protected].

The metric that matters most is not your click rate. It is your report rate. An organization where employees are clicking phishing links but also reporting them is in much better shape than one where nobody clicks but nobody reports either (because they delete everything suspicious without telling anyone).

Scaling the Program

Once the automated workflow is running, here are ways to level it up:

Increase frequency. Move from quarterly to monthly simulations once your team is comfortable with the program. More frequent simulations keep the training effect active.

Add difficulty tiers. Start with obvious phishing attempts and gradually increase sophistication. After a few rounds at the basic level, introduce spear-phishing simulations that reference real internal projects or use the names of real coworkers (with their permission).

Integrate with onboarding. Add a trigger in n8n that sends a welcome phishing simulation to new hires two weeks after their start date. This establishes the expectation from day one that phishing tests are normal and ongoing.

Add SMS phishing (smishing). If your team uses mobile devices for work, extend the program to include simulated text message phishing. This is a growing attack vector that most training programs ignore.

For businesses in DeLand and across Volusia County, our security services include managed phishing simulation programs that handle everything from template creation to result analysis. We also provide IT consulting in DeLand for businesses that want hands-on help with their security stack.

Building strong passwords alongside phishing awareness creates a layered defense. Check out our guide on password management for small teams for the complement to what you have built here.

The Bottom Line

Phishing training is not about catching people being careless. It is about building reflexes that work when a real attack arrives. The GoPhish and n8n stack in this guide runs itself after initial setup, costs nothing, and produces measurable improvements in your team’s ability to spot and report suspicious emails. Set up the automation, let it run, and watch your team get sharper with every simulation.

Frequently Asked Questions

Is it legal to send phishing simulations to my employees?

Yes, in the United States, employer-conducted phishing simulations are legal and widely practiced. You should inform employees that periodic security testing is part of your security program (usually through an acceptable use policy), but you do not need to announce specific campaigns. Consult your employment attorney if you have concerns about specific state regulations.

How often should I run phishing simulations?

Quarterly is the minimum effective frequency. Monthly is optimal for maintaining awareness. More frequent than monthly can cause “simulation fatigue” where employees become desensitized. Vary your timing — do not always send on the same day of the week or time of day.

What is a good click rate target?

Industry average for first-time simulations is 30-40% click rates. After 6-12 months of regular simulations with training, well-performing organizations achieve under 5%. Anything below 10% after your first year indicates strong security awareness.

Can I use GoPhish with Microsoft 365 or Google Workspace?

Yes. GoPhish sends emails via SMTP, which both M365 and Google Workspace support. You may need to whitelist GoPhish’s sending IP in your email security settings to ensure simulation emails are not filtered before reaching inboxes. Configure this carefully — you want the emails to arrive, but you do not want to weaken your email security for real threats.

What if an employee reports a real phishing email instead of a simulation?

Excellent — that means your training is working. Have a clear process for evaluating reported emails. In your n8n workflow, you can add an intake node that receives reported emails, checks them against your active GoPhish campaigns, and if it is not a simulation, escalates it through your incident response process.

How do I handle employees who repeatedly fail simulations?

After two failures, provide targeted one-on-one training. After three failures, have a conversation with their manager about additional training or access restrictions. The goal is never punishment — it is determining whether this person should have access to sensitive systems and ensuring they get the support they need to improve.

Phishing Training for Your Team: Automate It with This Free n8n Workflow