Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Run the exercise as a controlled learning test, not a covert trap: use fictional identities and synthetic messages, send links to a training-only page that cannot accept credentials, measure only the events needed to improve reporting, and delete event-level data on a documented schedule. Obtain leadership, security, and privacy or legal approval before sending, tell employees that randomized exercises occur, and make the exercise non-punitive.
What a safe nonprofit phishing exercise is designed to do
A phishing awareness exercise rehearses how people recognize and report suspicious messages before a real attacker creates pressure. NIST describes simulated phishing as a way to prepare employees for real-world phishing and provides the Phish Scale to rate how difficult a message is for a person to detect. CISA likewise recommends realistic simulations, clear reporting procedures, and recurring training. The Data Protection Commission (Ireland) identifies phishing and social engineering as routes to disclosure of sensitive information and malware installation.
As an Amazon Associate I earn from qualifying purchases.
For a nonprofit, the objective is narrower than “see who clicks.” You are testing whether the organisation can deliver a plausible lesson, whether staff know the approved reporting route, and whether the security team can respond. The exercise should never require access to donor files, beneficiary records, case-management systems, payroll data, health information, immigration information, volunteer records, or production credentials.
What the exercise should not be
- It is not a disciplinary investigation or a covert employee-performance ranking.
- It is not a request for real passwords, multifactor codes, payment details, uploaded documents, or address-book access.
- It is not a reason to impersonate a real bank, grant agency, regulator, partner organisation, donor, or beneficiary.
- It is not a test of donors, beneficiaries, external partners, or public mailboxes unless those groups receive a separate approval and risk assessment.
NIST SP 800-50 Rev. 1 states: “These activities should not be punitive, nor should any employee be called out for their response.” That principle should be written into the exercise plan before a message is drafted.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Start with a written purpose, scope and stop plan
Write a one-page exercise brief before configuring a platform or composing a lure. The brief gives reviewers a concrete object to approve and gives the operator a way to stop safely.
Define the learning objective
Choose one primary behaviour, such as reporting an unusual invoice request through the organisation’s reporting button, checking a request through a known contact method, or refusing to open an unexpected attachment. A single objective produces a more interpretable result than a message that tests delivery, link inspection, attachment handling, payment approval, and escalation at the same time.
Set the population and boundaries
- Name the departments, office locations, or role groups included.
- List excluded accounts, shared mailboxes, service accounts, executives whose schedules could create operational risk, and any team handling a live incident.
- State that no message will be sent to donors, beneficiaries, volunteers, external partners, or public addresses without separate written approval.
- Specify the sending window, maximum number of messages, approved sender domain, landing-page domain, and systems that may receive telemetry.
Choose success measures and stop conditions
Record the measures before launch so the team cannot change the goal after seeing results. Include delivery, click, attempted-submission, report, and median-time-to-report measures where they are needed. Define stop conditions such as an unexpected mail loop, reports from an external recipient, a real service disruption, a message that appears to involve a live incident, or any evidence that a credential or sensitive file was collected. Give the operator a tested kill switch and a named person authorised to use it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Set retention and ownership
Name the exercise owner, the small training team that may see any individual follow-up list, the system owner for mail and web logs, the privacy or legal reviewer, and the date on which raw event data and temporary message copies will be deleted. Keep the written plan and deletion evidence separately from the event-level results.
Get leadership, security and privacy approval before sending
NIST specifically recommends involving the legal team in the design and review of planned phishing exercises. The approval should cover the scenario, sender domain, landing page, telemetry, any vendor contract, the lawful basis where applicable, the retention period, and the deletion procedure. The ICO’s worker-monitoring guidance requires a clear purpose, data minimisation, security, transparency, and retention limits; its principle is direct: “you must not collect more information than you need to achieve your purpose.”
Questions for the review meeting
- Could the wording cause a recipient to contact a real bank, grant agency, regulator, or partner organisation?
- Could the link, attachment, redirect, or domain be mistaken for a production sign-in page?
- Does any tool store message bodies, screenshots, keystrokes, uploaded files, address-book data, or form fields by default?
- Where is the data processed and stored, and what processor and subprocessor terms apply?
- Who can view individual events, and are access logs enabled?
- Can the team disable sending and redirect all links immediately?
- What is the exact deletion date, and how will deletion be verified?
Advance transparency does not require revealing the date, theme, or recipient list. Tell workers that the organisation runs randomized awareness exercises, explain the purpose, describe the approved reporting channel, and state that results are used for learning rather than punishment.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Build synthetic messages and identities
Use fictional staff names, donation appeals, grant notices, invoice references, and project details. Invent the organisation, sender identity, account numbers, document names, and deadlines. Do not copy a real donor’s wording, a beneficiary’s case details, a volunteer’s contact information, a payroll record, a health or immigration reference, or a real grant application.
Keep the scenario realistic without borrowing a real brand
A useful message can imitate a common workflow without impersonating a real organisation. For example, it can describe a fictional “Northbridge Community Fund” requesting confirmation of a fabricated grant reference, or a fictional supplier asking staff to review a synthetic invoice. Do not use a real bank, regulator, grant agency, technology provider, partner, or charity name without explicit approval. NIST warns that such bait can trigger calls or messages to those entities and create harm outside the exercise.
Make the difficulty intentional
Rate the message with the NIST Phish Scale so a click or report can be interpreted in context. A message with a look-alike sender, an urgent deadline, an unusual request, and a mismatched domain is harder to detect than a plainly suspicious template. Do not compare raw click percentages across messages with different difficulty ratings or different recipient contexts. Increase difficulty gradually as reporting improves.
Isolate the landing page so no secret can be submitted
Host every destination on an approved training-only domain that is clearly separated from production identity, donation, case-management, finance, and document systems. Every button should terminate at an education page explaining that the message was a simulation and showing the cues the recipient could have checked.
Technical safeguards
- Do not present a username, password, multifactor-code, payment, donation, or document-upload field.
- Do not accept or store query-string values that could contain sensitive information.
- Do not run scripts that capture keystrokes, screenshots, clipboard contents, address-book data, or message bodies.
- Disable file uploads and avoid collecting browser fingerprints, precise location, or unnecessary device attributes.
- If a click identifier is required, use a random token that cannot be reused for authentication and that carries no employee name or account identifier.
- Ensure the training domain has no trust relationship with production single sign-on, mail, finance, fundraising, or case-management systems.
- Log only the minimum event needed to calculate the approved measure, and verify that web-server, proxy, analytics, and vendor logs do not create a second hidden copy.
A safe attempted-submission metric records that a recipient tried to submit, not what they typed. The destination should discard the request before any value is stored.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Collect the minimum telemetry
Aggregate counts are the default: number delivered, number of unique clicks, number of attempted submissions, number of reports, and median time to report. Aggregate by campaign, department, or time window only when that grouping is necessary for the learning objective and does not identify a small individual group.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
When individual follow-up is justified
Individual events may be necessary to offer a person a short remedial lesson or to check whether a reporting route worked. If so, export a pseudonymous identifier rather than a name where possible, restrict access to the small training team, enable access logging, and set a short deletion date. Do not publish leaderboards, name people in management reports, or send individual results to supervisors for disciplinary use.
Data that should never be retained
- Passwords, password-like strings, multifactor codes, security answers, or session tokens.
- Donor, beneficiary, volunteer, payroll, health, immigration, or case-management information.
- Uploaded attachments, address books, screenshots, keystrokes, message bodies, or copied clipboard contents.
- Unnecessary IP addresses, full user-agent strings, precise location, or persistent tracking identifiers.
- Temporary copies of the lure after the review period ends.
Give staff one clear reporting path
Before the campaign, publish the exact reporting action: one mail button, one mailbox, or one help-desk route. Use the same channel employees are expected to use for real suspicious messages. CISA advises verifying unusual requests through a known contact method rather than replying to the suspicious message, and reporting and deleting suspected phishing.
The education page should show the reporting button or mailbox, explain that replying to the suspicious sender is not the verification method, and provide a known phone or directory route for urgent cases. The reporting workflow should acknowledge receipt without exposing the reporter’s message to a broad audience.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRun a small pilot before the campaign
- Create a pilot group of designated internal accounts that represent the mail systems and roles in scope.
- Confirm that the message routes correctly, approved allow-listing is limited to the test infrastructure, and the sender cannot be confused with a production service.
- Open every link and attachment in an isolated test environment. Verify that all paths end at the education page and that no form value, file, or keystroke is retained.
- Check mail, web, proxy, security, and vendor logs for unexpected fields or duplicate copies of event data.
- Test the reporting button or mailbox, including who receives the report and what acknowledgement the reporter sees.
- Exercise the kill switch: stop sending, disable redirects, and preserve only the records needed to explain the stop.
- Confirm the deletion job, retention setting, access permissions, and audit evidence before expanding beyond the pilot.
Do not use beneficiaries, donors, external partners, or shared public mailboxes in the pilot. A separate approval is required if those audiences are ever considered.
Debrief immediately and support people who click
Redirect a participant who clicks to a short, calm explanation. Identify the cues in the message—such as an unusual sender domain, pressure to act, a mismatched link, or a request outside normal procedure—and show the correct reporting action. Keep the tone supportive; the goal is to make the next real decision safer.
Offer a brief remedial module or a conversation with the training team when the objective calls for it. Avoid public scoreboards, “worst clicker” lists, surprise manager notifications, or messages that imply a person endangered the organisation. If someone reports the simulation, acknowledge the desired behaviour rather than treating the report as evidence that the person should be monitored more closely.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Measure behaviour without inventing a pass mark
NIST identifies click-through and report measurements as common exercise metrics. A useful dashboard can include:
| Measure | What it tells you | Privacy-safe treatment |
|---|---|---|
| Delivery rate | Whether the approved mail route reached the intended internal accounts. | Report an aggregate count; investigate routing failures separately from human behaviour. |
| Click rate | How often recipients followed the synthetic link. | Use a random, non-authenticating token and do not attach a name unless follow-up is necessary. |
| Attempted-submission rate | Whether a recipient reached the point of trying to submit information. | Record only the event; discard every submitted value. |
| Report rate | How often recipients used the approved reporting channel. | Count reports in aggregate and remove message copies on schedule. |
| Median time to report | How quickly the organisation identifies and reports the exercise message. | Use event timestamps only for the stated analysis period. |
There is no universal “safe” click-rate target. Compare your own trend data by message difficulty, recipient context, department function, and reporting access. A lower click rate on an easier message is not automatically evidence of better resilience, and a higher rate on a deliberately difficult message is not automatically failure. The NIST Phish Scale provides the context for that interpretation.
NISTIR 8420A reported that just over 85% of surveyed participant organisations performed some type of phishing simulation. That is a finding about that survey population, not a benchmark or target for nonprofits.
Choose an implementation that preserves control
An in-house exercise can give a small nonprofit direct control over message content, hosting, logs, and deletion, but it requires staff to build safe redirects, permissions, reporting integration, and audit evidence. A vendor platform may reduce administrative work, yet it introduces processor, data-location, default-retention, and configuration risks. The decision should be based on controls rather than feature count.
| Decision axis | Questions to answer for an in-house build | Questions to answer for a vendor platform |
|---|---|---|
| Credential-capture prevention | Can every destination be hard-coded to a non-authenticating education page? | Is credential capture technically disabled, not merely discouraged in policy? |
| Synthetic content | Can fictional identities and attachments be enforced through review? | Can templates be edited without importing real contact or donor data? |
| Reporting granularity | Can aggregate results be produced without exposing individual events? | Can individual tracking be disabled or pseudonymised by default? |
| Data location and processors | Which internal systems store mail, web, and report logs? | Where are data and backups processed, which subprocessors are involved, and what contractual terms apply? |
| Retention and deletion | Can logs and temporary message copies be deleted on the written date? | Are retention settings, backup deletion, and deletion evidence available? |
| Access logging | Can least-privilege access and administrator activity be audited? | Does the service record access to exports and individual results? |
| Allow-listing and kill switch | Can sending and redirects be stopped immediately? | Can the organisation stop a campaign without waiting for support? |
| Reporting-channel integration | Can the existing report-phishing button or mailbox be tested end to end? | Does integration avoid copying message bodies or contacts into a new system? |
| Administrative effort | Who maintains domains, templates, testing, monitoring, and deletion evidence? | Who configures privacy-safe defaults, reviews updates, and handles incidents? |
Before signing with a processor, verify security controls, breach contacts, subprocessor terms, data-location commitments, retention settings, and the ability to export aggregate results while deleting event-level data.
Recommended Free Tools
Common failure modes and recovery actions
A message resembles a real organisation too closely
Stop the campaign, disable links, notify the exercise owner and privacy or legal lead, and assess whether anyone contacted the real organisation. Replace the scenario with a fully fictional identity and document the exception.
A participant enters a value into the page
Do not inspect or circulate the value. Preserve only the minimum technical evidence needed to confirm the control worked, disable the endpoint, verify that logs and backups did not retain the value, and follow the organisation’s incident process if any secret could have been exposed.
Reports go to the wrong mailbox
Use the kill switch, correct the routing rule, test with pilot accounts, and send a clear correction to affected staff. Do not treat a delivery or routing defect as a reporting failure.
Individual results are shared too widely
Stop distribution, revoke unnecessary access, record who received the export, and notify the privacy or legal lead. Replace the report with aggregate results and shorten the retention period for any remaining individual list.
The exercise is mistaken for a real incident
Stop sending, tell the incident lead and service owners, and provide a verified explanation through the normal internal channel. Review the scenario, timing, sender identity, and stop conditions before any later exercise.
Close the loop: review, delete and document
- Compare aggregate results with the stated learning objective and the message’s NIST Phish Scale difficulty.
- Record what improved or failed: delivery, reporting access, median reporting time, help-desk load, and the cues participants missed.
- Assign concrete changes, such as revising the reporting button, adding a short lesson on sender domains, or changing approval workflows for unusual payment requests.
- Remove raw event logs, temporary message copies, individual follow-up lists, and unnecessary exports by the written deadline.
- Verify deletion across the exercise platform, mail systems, web logs, analytics, backups where controllable, and staff workspaces.
- Store the exercise brief, approvals, aggregate findings, lessons, and deletion evidence with restricted access.
Repeat only when the next exercise has a distinct learning purpose, an approved scope, and a retention plan. A smaller, safer exercise that strengthens reporting behaviour is more valuable than a dramatic campaign that creates new privacy or operational risk.
Quick Recap
Governance checklist
- Written purpose, scope, owner, success measures, retention period, and stop conditions.
- Leadership, IT/security, and privacy or legal review, including a documented lawful basis where applicable.
- Advance notice that randomized awareness exercises occur and a clear non-punitive policy.
- No real credentials, donor records, beneficiary information, or sensitive attachments.
- No impersonation of real banks, grant agencies, regulators, or partner organisations without explicit approval.
- Training-only sender and landing domains with no credential capture or production-system trust.
- Aggregate reporting by default and least-privilege access for any individual follow-up.
- Verified processor terms, security controls, data location, deletion settings, and incident contact.
- Tested allow-listing, reporting channel, logging, and kill switch.
- Documented deletion date and evidence that event-level data was removed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
