Why it matters at small-team scale
One person clicking one convincing link is still the single most common way a company gets breached, and company size doesn't change that - it just changes how much you've tested for it. A simulated campaign tells you, with real numbers, who opened and who clicked, before it costs you anything.
How a simulation actually works here
You launch a campaign using a realistic template - a password reset, an invoice, a shared-document notice. It goes to the people you choose, tracks opens and clicks with a safe tracking pixel, and nothing in the message can actually harm anyone who clicks. Afterward you get a clear per-person result, not just an aggregate score.
What's bundled alongside it
A phishing simulation only tells you about people. The same mail-security tools also cover the domain side: a DMARC/SPF/MX check for your own domain, lookalike-domain detection for domains impersonating you, and a header analyzer for a suspicious message someone forwards you. It's the same underlying problem - people and domains both getting impersonated - covered from both directions.