01
E-mail scenarios
Realistic scenarios such as invoices, deliveries, password resets and requests from a manager.
Phishing Simulation
Most attacks start with an e-mail. We measure whether your team spots a fake one, before a real attacker sends it.
What it is
In a phishing simulation we send your staff harmless e-mails that look like real attacks. We measure who clicks the link, who enters information and who reports the e-mail, then follow up with short, practical training so the team learns to recognise fakes. The aim is not to blame anyone but to close the attacker’s easiest way in.
What we cover
0602
Fake sign-in pages
Simulation pages tailored to your company that measure whether details are entered.
03
Targeted scenarios
Role-specific scenarios for finance, HR and executives.
04
Reporting behaviour
How quickly a suspicious e-mail is reported to IT.
05
Awareness training
Short, practical training and reminders after each simulation.
06
E-mail security
SPF, DKIM and DMARC settings that stop your domain being spoofed.
How we work
- 01
Planning
Target groups, scenarios and timing are agreed with you, and IT is briefed.
- 02
Baseline
A first simulation measures where you are today.
- 03
Training
Teams get short training based on the results.
- 04
Repeat simulations
Simulations with different scenarios run at intervals.
- 05
Reporting
Click, submission and reporting rates are tracked over time.
What you get
- Click, submission and reporting results for each simulation
- Results by team or department
- Short training content for staff
- E-mail security (SPF, DKIM, DMARC) recommendations
When you need it
- If your team is growing or working remotely
- If you receive fake invoices, payment requests or e-mails posing as executives
- When ISO/IEC 27001 or a similar standard requires evidence of awareness training
- After a phishing incident, so it does not happen again
Methodologies & Standards
MITRE ATT&CK T1566NIST SP 800-50ISO/IEC 27001:2022SPF / DKIM / DMARCGDPR
Frequently Asked
Staff are not told the date in advance, otherwise the measurement loses its meaning. Management and IT are briefed, and everyone gets training afterwards.
That is your choice. We recommend reporting by team or department for most companies: the aim is to see where training should focus, not to punish people. Reporting follows data protection law.
Before the simulation we set up your mail server and security filters with your IT team, so the e-mails reach the inbox like a real attack would.
Related industries
More services in Cybersecurity
All ofCybersecurity- Penetration TestingWe find the gaps in your web, mobile, API and network before an attacker does.
- Source Code ReviewWe find vulnerabilities in the code itself, while it is still being written.
- Wireless (Wi-Fi) Security TestingWe test how exposed your office and guest Wi-Fi are to someone sitting in the car park.
- DDoS Resilience TestingWe measure, in a controlled way, whether your site and app stay up under heavy attack traffic.
- Active Directory and Internal Network TestingWe show how quickly an attacker inside your network could get from one laptop to the whole company.
- Cloud Security ReviewWe find public storage, excessive permissions and risky settings in your cloud accounts before an attacker does.
