- Home
- Phishing Simulator
Tools · Security awareness
Phishing Simulator — measure the human layer.
Run realistic, authorised phishing campaigns against your own organisation. Turn every click into a two-minute lesson, celebrate every report, and show auditors the improvement over time.
Features
Everything you need to run a phishing programme
Realistic campaigns
Templates based on the lures attackers actually use — invoices, payroll notices, shared documents, delivery alerts and login prompts.
Targeted audiences
Send by department, location or role, and stagger delivery so colleagues don't warn each other.
Teach at the moment of the click
Employees who click see a short lesson on the signs they missed, instead of an error page.
Reward reporting
Track who reports a suspicious email — the behaviour that actually stops attacks — not just who clicks.
Trends over time
Click and report rates by team and campaign, so you can show improvement quarter by quarter.
Audit-ready evidence
Campaign records and training follow-up that support ISO 27001, SOC 2, PCI DSS and regulator expectations.
How a campaign runs
Plan. Launch. Teach. Report.
Plan
Agree objectives, audiences and timing with your security and HR leads, and allow-list our sending infrastructure.
Launch
Run the campaign across a set window, with difficulty matched to your organisation's maturity.
Teach
Employees who click get immediate micro-training; repeat clickers can be assigned a full module.
Report
Results by team, trends against earlier campaigns, and recommendations for the next round.
Responsible use
Built to teach, not to trap
- Campaigns run only for organisations that authorise them, against their own people
- Scope, timing and messaging agreed with security and HR before launch
- Results used for learning and trends, not individual punishment
- Data handled in line with the DPDP Act, GDPR and your internal policies
FAQ
Common questions
Is phishing simulation legal?
Yes, when your organisation authorises it for its own employees and handles results in line with your policies and data protection obligations. We agree scope and approvals in writing before any campaign.
Will our email filters block the simulations?
They can. Before launch we help your IT team allow-list the simulator so results measure people, not your spam filter.
Should employees who click be disciplined?
We recommend against it. Punishment discourages reporting. The goal is learning and a rising report rate.
How often should we run campaigns?
Monthly or quarterly works for most organisations — often enough to build habits, not so often that people tune out.
Can results feed into our compliance evidence?
Yes. Campaign results and follow-up training records support awareness controls in ISO 27001, SOC 2 and PCI DSS.
Is it available on its own or only with training?
Both. You can run the simulator on its own, or combine it with our security awareness training programme.
See how your team responds to a realistic phish.
We'll show you the simulator and plan a first campaign around your organisation.