Phishing simulations
Train people with practice, not blame.
Agreed phishing exercises that look like the real thing, followed by short, friendly training at the moment someone clicks. Over time you see reporting go up and risky clicks go down.
- Starts with
- An agreed plan
- Who takes part
- Groups you choose
- Rhythm
- Monthly or quarterly
- Measured by
- Reports, not just clicks
Why it matters
Your people are not the weakest link. Untrained people are.
Most attacks still start with an email, a text or a phone call. Filters catch a lot, but not everything, and the message that gets through usually looks completely normal: an invoice, a shared document, a parcel notice.
Phishing simulations let your team practise spotting those messages in a safe setting. We send realistic, agreed scenarios, and anyone who clicks gets a short explanation of what they missed, right then, while it still makes sense.
We never name and shame. Results are shared as trends per team, and the number we care about most is how many people report a suspicious message, because that is what stops a real attack early.
Scope
What a programme includes
- 01ScenariosInvoices, shared files, delivery notices and sign-in pages tailored to your sector.
- 02Difficulty levelsFrom obvious to convincing, raised gradually as your team gets better.
- 03Teachable momentsA short page or video right after a click explaining the clues.
- 04Report buttonA simple way to report suspicious mail, and feedback when someone does.
- 05Phone & SMS (optional)Agreed vishing and smishing scenarios for teams that handle payments.
- 06TrendsClick, credential and report rates per team over time, never a list of names by default.
How an engagement runs
From first call to lasting result.
- 1Signed programme plan
Agree the plan
We decide together who takes part, which scenarios are acceptable, who is informed, and how results are shared. HR and works council can review it first.
- 2Baseline per team
Baseline
A first, moderate scenario shows where you stand today without making anyone feel caught out.
- 3Monthly results
Practise
Regular scenarios with rising difficulty, each followed by short training for anyone who clicked or entered details.
- 4Quarterly review
Review
Every quarter we look at the trend together and adjust scenarios to the threats we actually see against your sector.
What you get
A quarter at a glance
Illustrative example. Your own results appear in your console and in a weekly report you can forward as is.
sentShared invoice from a look-alike supplier domaintrendReports up, credential entries down since the baselineteamFinance improved most, sales needs a refreshernextNext round adds a fake parcel notice by SMSnoteNo individual names shared unless you agreed itHow we work
Rules we don't bend.
Agreed up front.
Scenarios, participants and data use are signed off before anything is sent.
No blame.
Results are about teams and trends, not catching individuals.
Fair scenarios.
No fake bonuses, layoffs or health scares. Some lures do more harm than good.
Reporting is the goal.
We celebrate people who report, not just those who do not click.
A good fit when
- You want awareness that changes behaviour, not a yearly slide deck
- A customer, insurer or standard asks for security awareness training
- Your finance or support team handles payments and requests by email
Not the right start when
- You want to test one specific person (we do not run targeted tests on individuals without HR and legal involved)
Will employees feel tricked?
We announce that the programme exists, without saying when. Combined with no-blame follow-up, most teams experience it as useful practice.
Do you see who clicked?
Technically yes, but by default we report per team. What we share and with whom is agreed in the plan.
Is this GDPR-compliant?
We process only what is needed, agree data use in writing and keep results for a limited, agreed time.
Can we use our own scenarios?
Yes. If you have seen a real phishing mail recently, it often makes the best next exercise.
More of what we do
Secure smarter.
Know where you stand.
Run the free domain scan now, or talk to us about a full outside-in look.