Phishing Simulation Services

We start with a short call to agree the target population, the pretexts that are fair game, and the off-limits topics. Some subjects, like bogus redundancy notices or fake medical alerts, cause real distress and we steer clients away from them. A named sponsor inside your business signs off the rules of engagement, and we work under NDA throughout.

Attackers research before they send. So do we. We gather public information about your organization: supplier names, the format of your email addresses, recent press, job titles on LinkedIn. From that we craft lures that feel native. A finance team might see an invoice query from a genuine-looking vendor. IT might get a fake ticket from the helpdesk platform they actually use.

We stand up dedicated sending infrastructure on GoPhish-style tooling with freshly registered look-alike domains, valid TLS certificates and warmed sender reputation, so the mail behaves like a real campaign rather than something your gateway trivially bins. Where you want to test detection, we can also send from domains your filters have never seen. Every message is tagged so we can trace exactly who received, opened, clicked and submitted.

During the window we watch the metrics in real time. If a genuine incident looks like it is brewing, we tell your security contact at once so nobody wastes an afternoon chasing our test. Afterward you get the full picture: open rates, click rates, credential-submission rates, the median time to click, and, just as important, how many people reported the mail to your abuse mailbox.

Broad, generic phishing catches the careless. Targeted spear-phishing catches almost everyone the first time, because it references real people, real projects and real deadlines. We test both, so you can see the gap between baseline awareness and resistance to a tailored attack.

Stealing a password is only step one now that most companies run multi-factor authentication. We test the follow-through: consent-phishing that tricks a user into approving a malicious OAuth app, and MFA-fatigue pushes that bombard someone with prompts until they tap approve to make it stop. These are the exact paths behind several large European incidents in recent years.

Not every attack arrives by email. A phone call from the “IT helpdesk” asking someone to read out a code, or a text message about a stuck parcel, can be more effective than any inbox lure. Where scope allows, we add scripted voice and SMS pretexts so you understand exposure across every channel your people use.

We report the numbers that predict real-world compromise: click rate, credential-submission rate, and the report rate that tells you how many people did the right thing. We break these down by department and seniority, because the pattern in a finance team differs from the pattern in engineering, and your training budget should follow the risk.

People remember a lesson best right after they make the mistake. Anyone who clicks is shown a short, non-shaming teachable page that explains the specific cues they missed. We can pair this with role-based training modules and a recommended cadence, so the simulation becomes a program rather than a one-off scare.

A single campaign is a snapshot. Improvement is a trend. Every engagement includes a follow-up round after your training, at no extra cost, so you can show the board that click rates fell and reporting rose.

ISO 27001:2022 control A.6.3 requires information-security awareness, education and training, and auditors increasingly want evidence that the training is measured, not just delivered. PCI DSS 4.0 requirement 12.6 mandates a formal security-awareness program with periodic testing. A documented phishing simulation gives you that evidence in a form an assessor recognizes.

Under the GDPR, article 32 expects appropriate organizational measures to protect personal data, and staff susceptibility to phishing is squarely an organizational risk. For operators in scope of NIS2, human-risk testing supports the required cyber-hygiene and training measures. Financial entities under DORA can fold awareness metrics into their ICT risk-management reporting. We map findings to the framework you name so the report earns its keep at audit time.

We recommend an initial baseline campaign to establish honest starting figures, followed by quarterly rounds with fresh pretexts. Attackers rotate their lures constantly, and staff quickly learn to spot a template they have seen before, so repeating the same email teaches nothing. Rotating themes keeps the exercise honest and the training relevant.

The best moments to run a simulation are after onboarding a group of new hires, following a policy change, or in the run-up to an audit that expects awareness evidence. A campaign timed to a merger or a major product launch also reflects when attackers are most likely to strike, because those are the moments your staff are busiest and least suspicious.

Boards respond to direction of travel, not a single percentage. We present click and report rates as a trend across rounds, so you can show that investment in awareness is paying off and pinpoint the teams that still need attention. That trend line is often what unlocks continued budget for security training.