Phishing simulation and awareness tools
Technical controls catch most phishing, but not all of it, and the last decision is made by a person. Awareness programs send realistic test messages, teach the person who clicked and, more usefully, measure how many people report a suspicious message.
What we do
- Program design and rules of engagement
- Simulation content tailored to the business
- Report-a-phish workflow and triage
- Metrics for management and insurers
- Targeted training for finance and executives
- Onboarding and annual training
- Integration with mail security
Our team works with KnowBe4, with the attack simulation training built into Microsoft Defender for Office 365, with Proofpoint security awareness, and with the open-source GoPhish for controlled tests. We write simulations that match the customer's real risks, such as invoice changes, shared document links and voice phishing, and we agree rules of engagement first so that staff, HR and executives are not surprised.
This group links to our Security Awareness Training and Cybersecurity services. We report the rate at which staff report messages as well as the rate at which they click, and we do not use tests to punish people. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- KnowBe4
- Microsoft Defender for Office 365 Attack simulation training
- Proofpoint Security Awareness
- GoPhish
Platforms and practices
- Phishing simulation campaigns
- Report-a-phish button
- Training assigned after a click
- Reporting rate and click rate metrics
- Business email compromise and invoice scenarios
- QR code and voice phishing scenarios
- Allow-listing the simulation sender
- Executive and finance team targeting
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Phishing simulation and awareness tools for clients
Security Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreEmail Security, Archiving & Continuity
Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageIs it fair to test employees with fake phishing emails?
It is when done with care. We agree rules of engagement with you first, tell staff that tests happen, avoid lures that exploit fear, such as a fake bonus or layoff, and treat a click as a reason to teach, not to punish. The aim is to measure how many people report a message, which is a better sign of a healthy culture than a low click rate.
What should we measure?
The report rate, meaning how many people flag a suspicious message, and how fast. Click rates move with the difficulty of the lure and are easy to misread. We also look at repeat patterns by department so training can be directed, and we show the trend over time instead of a single result.
Does awareness training replace email security?
No. Filtering, DMARC enforcement, multi-factor authentication and endpoint protection stop most attacks before a person sees them, and phishing-resistant sign-in limits the damage when someone is fooled. Training is the last layer, for what gets through, and it works best with an easy way to report a message.
Can you simulate more than email?
Yes. We can simulate text messages and voice calls where the platform and your rules allow, and we base scenarios on your real risks, such as invoice changes, shared document links and requests to reset a password. Anything beyond email needs a written scope and your approval.