All services Phishing Simulation
Practise on realistic attacks before a real one arrives.
We send safe, convincing test emails written the way attackers write them today. When someone slips, they get a two-minute lesson on the spot. You see reporting go up over time.
Before AI
IT Departmnet <[email protected]>
URGENT!! Your acount will be closed
Dear Valued User, your mailbox have exceeded it limit. Click here imediately to verify you account or it will be deleted.
- Typos
- Generic greeting
- Odd sender
Now
Martin Roy <[email protected]>
Re: Q3 supplier payments
Hi Julie, thanks for sending the list this morning. Novatek just told me their bank changed after the audit, so please use the attached details for today’s payment. I’m in meetings until 4, I’ll sign off when I’m out.
- No typos
- Real names, real context
- Reply in an existing thread
Try it: what would you do?
This is the kind of email our simulations send. Pick an answer.
Martin Roy <[email protected]>
Re: Q3 supplier payments
Hi Julie, Novatek’s bank details changed after their audit. Please use the attached details for today’s payment. I’m in meetings until 4.
PDF Novatek_banking_update.pdf
This is exactly how most invoice fraud succeeds. The thread and names can be real: the mailbox may be compromised.
If the mailbox is compromised, the attacker answers “Yes, go ahead.”
Right. A second channel you already trust beats any clue in the email.
Also right. Reporting fast lets IT check whether others got it too.
How a campaign runs
- PlanLures based on your suppliers, tools and roles.
- SendSafe test emails, spread over days so nobody tips off the team.
- TeachA short lesson the moment someone clicks.
- MeasureReports, clicks and time-to-report, by team.
Lures we use
Every campaign also includes custom scenarios built for your company: your real suppliers, tools, events and the way your people actually work.
- FinanceBank details changeSupplier asks to update payment info
- EveryoneMFA approvalA sign-in prompt nobody started
- EveryoneShared fileA document “shared with you”
- MobileQR codeScan to keep your account active
- CustomBuilt for youA scenario only your company would recognise, from your suppliers to your internal tools.
What we measure
Clicks alone say little. We track whether people report, and how fast.
First campaignFourth campaign
Reported the email
Clicked the link
Median time to first report
Examples on this page are illustrative.
Plan a campaign
Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.