Phishing simulation (up to 100 people)
Phishing simulation for your team
We send your team a trap email like the real ones, give them a short talk and send another. You see how many fall for it today and how much they improve, by area and without pointing at anyone.
Two-campaign phishing simulation with a baseline and a follow-up measurement: click, credential submission and report rates by area, with a 20-minute training in between.
- Duration
- 3 weeks
- Start
- Within 1 week
from US$990
Buy it on its own or add it to an audit. Retests: added to an audit, the same as that audit; on its own, 3 months at no charge.
Measure my teamHas someone already entered their password from a fake email? Change it now and write to us today.
It is for you if
- You want to know how many people on your team would click a fake email.
- Your insurer, a customer or a standard asks you to train staff and measure it.
- You already gave a security talk and do not know whether it worked.
What we measure
How many go as far as typing their password on the fake page.Credential submission rate; the page does not store the password, it only records that one was sent.
How many report that they got something odd, which matters most.Report rate and time to the first report.
How much the team improves from the first email to the second.Comparison between campaigns of the same difficulty.
How we work
Week 0
Scope
Leadership signs the authorization, sends us the email list and picks the lure from real examples.
Written authorization, allow-listing in your email, areas and a scenario approved by leadership.
Week 1
First email
We send the first trap email without warning the team and measure what happens.
Campaign 1 (baseline) over 5 business days.
Week 2
Talk
A 20-minute talk with the email they got and how to spot it. It is recorded for anyone who misses it.
20-minute live and recorded training, with the aggregated results of campaign 1.
Week 3
Second email
We send another trap email, different but just as hard, and hand you the report.
Campaign 2 of equivalent difficulty, comparative report and a 30-minute wrap-up meeting.
What you get
- A report by area: how many fell for it, how many reported it and how much they improved.
- Report aggregated by area, with no personal data, comparing both campaigns.
- The recorded talk, to use with new hires.
- 20-minute video and a sheet with the signs of a fake email.
- What to change in your email so fewer traps reach the inbox.
- Recommendations on filtering, a report button and domain protection.
Scope limits
Includes
- Up to 100 people.Up to 100 email addresses.
- 2 trap emails and 1 talk of 20 minutes.2 campaigns and 1 recorded training.
Does not include
- We do not give you names of who fell for it: the report is by area.No individual results; it avoids labor and personal data issues.
- We do not call or send text messages: email only.No vishing or smishing; the cloned-voice drill is in Cheshire.
- We do not keep any password anyone types.The fake page discards what is typed and only records the submission.
More than 100 people or campaigns all year? We give you a fixed price before signing.
Questions before you buy
Is it legal to send my team a trap email?
Yes, with written authorization from leadership, a training purpose and no personal data kept. That is why the report is by area and we never keep passwords.
Why do you not give me the names?
Because the goal is for the team to improve, not to punish someone. When people fear being exposed, they stop reporting, and reporting is what protects you most.
Can I buy it without an audit?
Yes. Buy it on its own or add it to Dig, Rabbit Hole or Warren.
How many on your team would fall for it today?
In 3 weeks we measure it, train the team and measure again.