Phishing exercises take on many variations and there is no absolute definition for the categories. For this course, I categorized these into the three most common assessment types:

Security Awareness Campaign
Phishing Security Assessment
Red Team Engagement

Security Awareness Campaigns aim to increase the awareness of users regarding safe behavior on- and offline. Phishing is often a big part of this. These exercises focus purely on the human aspect and do not attempt to bypass any security measures in place. For the best results, these exercises are best repeated regularly.

Phishing Security Assessments assess both the human and technical protections of an organization against phishing attacks and identify potential vulnerabilities. These exercises identify misconfigurations and bypasses for technologies such as mail and web filtering. No defensive actions are taken by a Blue Team or IT support and obtained access is not further abused. These are mostly standalone engagements.

Red Team Assessments assess the security posture of an organization as a whole including both technical and human aspects. During these engagements a Red Team (attacker) is simulating a real attack and assess/train the Blue Team (defender). From the perspective of an external attacker, a Red Team tries to gain access to the crown jewels of an organization without being noticed and blocked. Phishing is often used to obtain an initial foothold in the network from which a Red Team proceeds to further phases of the killchain.

Exercise	Security Awareness Campaign	Phishing Security Assessment	Red Team Assessment
Human aspect	Yes	Yes	Yes
Technical aspect	No	Yes	Yes
Goal	Training	Identifying vulnerabilities	Identifying vulnerabilities
Frequency	1/week - 1/year	<1/year	< 1/year (only mature companies)
Number of targets	All employees	5 - all employees	1-5 employees
Stealth	No	No	Yes
Actions of defender	No	No	Yes