The scenario sends staff safe simulated phishing emails and records who clicked the link — so you know who needs training.