# Attack Simulation Training is configured and a baseline simulation has been run in the last 12 months
Attack Simulation Training in Microsoft Defender for Office 365 P2 launches benign phishing campaigns against a tenant's own users, measures their…
Source: https://maester.dev/docs/tests/ZTA.41036
## Overview
Attack Simulation Training in Microsoft Defender for Office 365 P2 launches benign phishing campaigns against a tenant's own users, measures their behavior (delivery, click, credential entry, attachment open, OAuth consent grant), and assigns role-appropriate training to users who fail. Technical defenses suppress most phishing, but a non-zero rate of malicious messages reaches inboxes; the only durable mitigation for that residual is users who recognize and report the lure rather than clicking it. Without an Attack Simulation Training program the tenant has no measurement of click rate, no stratification of repeat-clickers, no baseline against which to measure improvement, and no enforced training assignment when a user does click. Microsoft's recommended baseline is an automated simulation series running quarterly with payloads representative of current attacker patterns, automatic training assignment from the Microsoft Training catalog, and regular review of click rate, training completion, and repeat-offender lists.
## Remediation
- [Get started using Attack Simulation Training](https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started)
- [Simulate a phishing attack](https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-simulations)
- [Simulation automations](https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-simulation-automations)
- [Insights and reports](https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-insights)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Email and collaboration security |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Tenant settings |
| Area | Email and collaboration protection |
| ATT&CK | [T1566](/docs/tests?mitre=T1566) Phishing |
| Licence | THREAT_INTELLIGENCE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.