- Home
- Offensive Security & Hunting
- Phishing simulation
Training says they were taught.
A simulation shows if it worked.
We run controlled phishing, smishing and pretext campaigns against your staff, measure who clicks, who enters credentials and who reports, and turn every click into a short lesson.
Measure the behaviour, not the attendance.
Annual awareness training tells you staff sat through it. A phishing simulation tells you whether they would fall for a real attempt, and which departments need help. Run well, it shows measurable improvement campaign over campaign. Run badly, it breeds resentment. We run it to teach.
Our scenarios reflect what attackers are actually sending: credential harvesting against Microsoft 365 and Google Workspace logins, CEO impersonation aimed at finance, fake vendor invoices, QR-code lures and text messages. When someone clicks, they land on a short page explaining exactly what they missed.
- Campaigns designed around current attacker technique, not stock templates
- Click, credential-entry and report rates by department and role
- Just-in-time training pages and short follow-up modules for clickers
- Repeat-clicker tracking with a coaching path, not public shaming
- Trend reporting across campaigns, with a board-ready summary
Baseline, teach, re-measure.
Plan
We agree scope, scenarios and who is told in advance, and align with HR and any works council or union requirements.
Baseline campaign
A first campaign establishes where you stand, by department and role.
Teach
Clickers get immediate, specific training. People who report the email are recognised for it.
Re-measure
Follow-up campaigns track whether click rates fall and report rates rise, and where to focus next.
What real attackers send.
Credential harvesting
Convincing login pages for the cloud services your staff use every day.
Executive and vendor impersonation
Business email compromise aimed at finance, procurement and payroll.
Smishing and QR lures
Text messages and QR codes that move the attack off the corporate mail filter.
Voice pretexting
Calls to the helpdesk or front desk to test whether procedures hold, where in scope.
Who it is for
Any organization with staff and email. A favourite of compliance and HR teams who need evidence that awareness training is changing behaviour, and of leaders who want to know which departments are most exposed.
- SKULD security awareness, the training programme behind the simulation
- Ransomware readiness, phishing is how most ransomware starts
- Email security, stop more of it before it reaches staff
- vCISO, fold results into your security programme
What buyers ask.
We do annual awareness training.
Training tells you people were taught. A simulation tells you whether it worked, by department, and gives you a baseline to improve against.
Won't staff feel tricked?
Not if it is run to teach. Clickers get a short, helpful explanation, not an email to their manager. People who report the message are recognised, so the habit you want is the one that gets rewarded.
Our email filter blocks phishing.
Some always gets through, and smishing, QR codes and phone pretexts bypass the mail filter entirely. The simulation tests the person, who is the last control.
How often should we run campaigns?
Regularly enough to see a trend. We recommend a cadence after the baseline, based on your results and any compliance requirement you report against.
Find out who would click.
Put an engineer on a call to plan a baseline campaign for your staff. No charge, no commitment.