For companies and their employees
Phishing simulations for employees
Find out how your people respond to fraudulent messages before an attacker does. We prepare a realistic campaign and evaluate it. We are not looking for someone to blame. We want people to recognise a scam and report it.
Discuss a phishing simulationCampaigns we run
We choose channels and scenarios based on how attackers would most likely target your company. A campaign can combine several channels.
Emails and targeted spear phishing
Fraudulent emails for the whole company, such as a fake login, an invoice or a shared document. For management, accounting or HR, we write tailored messages.
Phone calls (vishing)
A member of our team calls using prepared scenarios, for example posing as the helpdesk, a supplier or a colleague from management.
SMS and QR codes
Fraudulent SMS messages (smishing) and QR codes that lead to a fake login page. We check whether people stay alert outside email too.
What you receive
- Aggregated results: how many people opened the message, clicked, entered credentials or reported it.
- Whether fraudulent messages get past your email filtering.
- Recommendations on which teams and types of scam to focus on.
How a campaign works
Kick-off meeting
We discuss the campaign goal, channels, target groups and the main metric we will use to evaluate results.
Scenario approval
We prepare the scenarios and fraudulent messages. Nothing is sent until you approve them.
Technical preparation
We use domains similar to yours. We agree whether to test your email filtering too or have you allow the messages through (whitelisting).
Campaign launch
The campaign runs from one day to two weeks, depending on its scope.
Evaluation
We summarise the results in a report. By default, results are aggregated, without the names of individual employees.
What we build on
Red teaming experience
Martin has worked in red teaming and IT security for over 20 years. We build scenarios on what attackers actually use.
ENGETO
A long-term partnership in cybersecurity education, including leading ethical hacking academies.
Phishing quiz
In our free quiz, anyone can test whether they can spot a fraudulent message.
Common questions
Will management learn who clicked?
Not by default. We report results in aggregate, because the goal is to improve how the whole company responds, not to punish individuals. If you explicitly need a list of names, we can provide one.
Do you store the passwords people enter?
Not by default. We only record that someone entered credentials. We store the passwords themselves only if you explicitly ask us to.
What do you measure?
Opening the message, clicking the link, entering credentials, opening an attachment and reporting a suspicious message. We agree the main metric based on the campaign goal. It is also worth tracking how many people report the message.
Will employees see right away that it was a test?
On request, we show a page after the click that explains it was a simulation and points out the warning signs. By default, the campaign runs to the end without any notice.
How much does a simulation cost and how long does it take?
Preparing, running and evaluating a campaign takes from 20 hours of work, and the price depends on the number of hours. The campaign itself runs from one day to two weeks. We are a nonprofit association and not VAT-registered, so the price in our quote is final.
How do you handle data?
Before starting, we sign an NDA and a data processing agreement. We delete raw campaign data when the engagement ends and keep only the report.
Does a simulation have to be combined with training?
No. A simulation is a standalone service. We offer training separately if you are interested.
Do you also run physical social engineering tests?
We handle physical tests, such as attempts to enter a building, individually. Tell us what you need to verify.
Want to know how your people would respond?
Tell us how many people the campaign should include, which channels interest you and when it would suit you. The initial 30-minute consultation is free.
Discuss a phishing simulationDo your employees also need training?
Cybersecurity training for employees