Phishing Simulation by Industry: Where It Is Especially Important and Which Channels Count

Why phishing simulations must cover all channels

A phishing simulation is a controlled, authorised test attack on an organisation's own employees. It shows who recognises a fraudulent message, reports it or acts on it. For a long time, it consisted only of fake emails. Real attacks now use every channel through which employees can be reached.

In its Threat Landscape Report 2025, CERT-EU notes that social engineering is moving beyond email, for example to voice phishing and AI-generated deepfakes. The Verizon Data Breach Investigations Report 2026 reports 40 percent higher click rates for attacks on mobile devices, such as fake text messages or scam calls, than for traditional emails.

• Email: fake invoices, login pages and approval requests.
• SMS (smishing): parcel notifications, MFA codes and supposed IT notices on smartphones. Private devices come with their own rules, which the article on smishing simulation on BYOD devices explains.
• Phone (vishing): calls from supposed IT support, the bank or senior management, increasingly with cloned voices.
• Messengers and collaboration tools: messages via WhatsApp or Microsoft Teams feel more personal than an email and bypass email filters.
• Video: deepfakes of executives in online meetings confirm requests that started by email.

A multi-channel phishing simulation combines these channels the way real attacks do, for example an email followed by a phone call.

What the law requires and what it does not

DORA and the German BSI Act (BSIG) require training and awareness measures. Neither explicitly prescribes phishing simulations. Simulations are, however, a common way to check whether training works in day-to-day practice.

• DORA (financial sector): Under Article 13(6) of Regulation (EU) 2022/2554, financial entities must include ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training. These apply to all employees and to senior management, at a level of complexity that matches each role.
• BSI Act (German NIS2 implementation): Under Section 30 BSIG, essential and important entities must, among other things, implement basic training and awareness measures and have procedures to assess the effectiveness of their measures. Management must implement and oversee these measures and take part in regular training itself.

Whether a company falls under the BSI Act depends on its sector and size. Smaller companies outside the covered sectors do not have these obligations. For them, awareness training remains voluntary but useful. The overview of NIS2, ISO 27001 and BSI Grundschutz shows which requirements follow from NIS2 and common standards.

How we assessed the industries

The matrix is an editorial, risk-based classification. It is not a scientifically measured ranking and is not based on numerical scores. Each industry was assessed against five questions.

• Threat landscape: how strongly the industry is targeted by social engineering and fraud, based on sources including ENISA, CERT-EU and Verizon.
• Regulation: whether a law such as DORA or the BSI Act requires training and awareness measures.
• Consequences: the potential economic and operational damage, for example the average cost of a data breach according to IBM or outages of critical services.
• Channels: how many channels employees use to communicate with external parties and how important these channels are to the business.
• Exposed roles: whether there are roles and processes that attackers specifically target, such as payment approvals, customer service or the help desk.

The y-axis combines threat landscape, regulation, consequences and exposed roles into the relevance of phishing simulations. The x-axis shows channel exposure. The further right an industry sits, the more channels a simulation programme should cover. Data breach costs serve only as an indicator of potential consequences. They do not measure how susceptible an industry is to phishing.

The classification shows where phishing simulations are especially urgent and which focus makes sense. It does not mean that industries lower in the matrix can do without them. Phishing affects companies in every industry.

The matrix: phishing simulation by industry

The scenarios are illustrative examples of realistic exercises. They do not indicate which attack type is statistically most common in an industry.

Especially important: banking, insurance and healthcare

Phishing simulation for banks

Banks fall under DORA and must offer ICT security awareness as a compulsory module for all employees. According to the IBM Cost of a Data Breach Report 2026, data breaches cost financial organisations an average of USD 6.29 million, the second highest figure of all industries. The global average was USD 4.99 million.

Banks talk to customers through almost every channel. Attackers pose as corporate clients or board members towards employees and as the bank towards customers. Roles with payment approval rights, corporate client advisers and customer service are particularly exposed.

Typical scenario: A caller poses as the managing director of a corporate client and demands, under time pressure, the approval of an international transfer. The exercise tests whether employees call back on a known number and apply the four-eyes principle.

Phishing simulation for insurers

Insurance undertakings are also financial entities under DORA. Claims, contract changes and payouts often run by phone and email. Contact centres are therefore a preferred target, because employees there are expected to help callers and work under time pressure. The article on contact centres as vishing targets explains why.

Typical scenario: A supposed policyholder calls, quotes correct contract details gathered from public sources and asks to change the bank details for an upcoming payout. The exercise tests whether the caller's identity is verified through an independent channel.

Phishing simulation in healthcare

No sector has more expensive data breaches. According to IBM, an incident in healthcare cost an average of USD 6.64 million in 2026, the highest figure of all industries for the 13th year in a row.

In its NIS360 report 2026, ENISA counts healthcare among the sectors whose cybersecurity maturity is below average while their criticality is high. In Germany, the sector falls under the NIS2 obligations of the BSI Act.

Hospitals, practices and laboratories work in shifts, at shared workstations and with many external partners. Much of their communication runs by phone and email, for example with laboratories, health insurers and referring practices.

Typical scenario: An email in the name of a known laboratory announces an urgent test result and links to a fake lab portal with a login page. A second variant is a call from supposed IT support during the night shift asking for a one-time password.

Also important: energy, public administration, IT, manufacturing, retail and logistics

The German NIS2 implementation applies to many companies in these industries, provided they meet the size thresholds. According to ENISA, 73 percent of the organisations targeted in the EU in 2025 were essential or important entities under NIS2.

• Energy & utilities: A successful attack can affect supply. Channel exposure is lower than in banking, but control rooms, IT and procurement are particularly exposed. Scenario: A supposed maintenance provider calls and asks for short-notice remote maintenance access.
• Public administration: According to ENISA, public administration was the most targeted sector in 2025, with 32 percent of recorded incidents. Most of these were DDoS attacks, not phishing. Authorities nevertheless handle many requests by email and phone, and ENISA rates their cybersecurity maturity as below average. Scenario: An email from a supposed citizen contains a link to “application documents” that require a login.
• IT & technology: IT service providers often have access to their customers' systems. ENISA counts ICT service management among the sectors with below-average maturity. IBM puts the average cost of a data breach in the technology sector in 2026 at USD 5.50 million. Scenario: A supposed customer admin contacts the help desk via Microsoft Teams and asks for an MFA reset.
• Manufacturing: Fake supplier invoices and changed bank details hit procurement and accounting. IBM also puts the average cost of a data breach in the industrial sector in 2026 at USD 5.50 million. Scenario: A known supplier announces new bank details by email, and a follow-up call is meant to confirm the change.
• Retail & e-commerce: Many customer channels and high staff turnover make consistent awareness harder. Scenario: A messenger message in the name of an angry customer contains a link to supposed photos of a damaged delivery.
• Logistics & transport: Drivers, dispatchers and warehouse staff work on the move and are mainly reachable by SMS and phone. ENISA rates sub-sectors such as rail and maritime as below-average in maturity. Scenario: An SMS announces a short-notice order change and links to a fake driver portal.

Targeted use: education, research, construction and real estate

These industries are not low-risk. Their risk is, however, concentrated in specific roles and processes rather than across the whole workforce.

• Education & research: Universities and research institutions have open structures, many changing users and valuable research data. Scenario: An invitation to a research collaboration links to a fake login page for a document portal.
• Construction & real estate: Projects and transactions involve large individual payments, which makes fake payment instructions attractive. Accounting, project management and transaction teams are particularly exposed. Scenario: An email on behalf of a notary announces changed account details shortly before a payment.

For these industries, regular email simulations for everyone and targeted phone exercises for roles that approve payments or change bank details are a good fit.

How revel8 steers phishing simulations by role and risk

The industry determines which channels matter. Within a company, however, risk differs from person to person. An accountant with payment approval rights needs different exercises than a developer or a customer service employee.

revel8 therefore takes employee types, risk clusters and actual employee behaviour into account. The Awareness Playlist builds an individual sequence of simulations across email, SMS, phone and video for each person, based on role, past behaviour and learning progress.

With Risk Monitoring & Mitigation, security teams see in which risk clusters risky behaviour is concentrated and can target measures there.

Scenarios are based on threat intelligence and OSINT, meaning current attacks and publicly available information about the company. For insurers, banks and other organisations with customer service, the contact centre module adds vishing simulations. We can show what this looks like for your industry in a demo.