The human factor · email

Phishing simulations for your team

Most attacks start with an email. We send a realistic, controlled one and measure how many people recognise it — so you know where training is needed.

Standard, branded, spear phishingResults per departmentTraining after the campaign
Request a quote →How we work
What we test

Three levels of difficulty

From the message anyone might receive to one written for a single person.

Standard

Generic messages of the kind circulating every day: parcels, invoices, expiring passwords. They show the baseline of vigilance.

Branded

Messages imitating the services and suppliers your company uses, with personalised landing pages.

Spear phishing

Targeted attacks on a few key people (management, accounting, IT), built from what is public about them — the way a real attacker works.

Request a quote

Build your request in two minutes

Three steps, no prices to guess: tell us what you have, and within one business day you receive the scope, duration and schedule of the test.

  1. 1 What we test
  2. 2 How and when
  3. 3 Where we reply
What kind of campaign?
How many employees receive the messages?
How many campaigns?
Employee training after the campaign?
Does a regulation or audit apply to you?
When do you need the report?
One per line. Nothing is tested before a signed authorisation.

We use your details only to answer this request. Privacy policy

Methodology

How the project unfolds

Every campaign is agreed in advance and runs only within the window in the signed authorization.

  1. Scope and quote

    You tell us how many people and which departments are in scope and which kinds of messages you want; you receive a quote within one business day.

  2. Authorization and scenarios

    You sign the authorization; the scenarios, the list of people and the schedule are agreed with you before the first message.

  3. Preparation

    We write the messages and, where relevant, the landing pages, in your company’s language and style.

  4. The campaign

    We send within the agreed window and track who opens, who clicks, who enters data — and who reports the message to the security team.

  5. Report and training

    You receive the results per campaign and per department and, on request, training for employees built on examples from the campaign.

What you receive

Deliverables

  • Campaign results: how many opened, clicked, entered data or reported — by name or aggregated only, as the authorization sets out
  • A comparison by department, so training goes where it is needed
  • The warning signs each scenario carried, explained
  • Technical recommendations: filtering, domain authentication (SPF, DKIM, DMARC), reporting
  • On request, post-campaign training and repeat campaigns, so you can see progress
Further reading

Guides related to this service

Moldova cybersecurity law guideISO 27001 and SOC 2 guideDORA and TLPT guideNIS2 and GDPR guide
FAQ

What clients ask us

How long does a campaign take?
Usually 1–2 weeks from signing the authorization to the report; in urgent mode, 3–5 days.
Do employees find out they were tested?
Yes: the aim is for them to learn, not to be caught. You decide how and when to tell them; we recommend doing it together with the training, using examples from the campaign.
Can the campaign disrupt work?
Messages go only to the agreed list, within the agreed window, and your IT team knows in advance how to recognise them if something needs to be stopped.
Do you work with small companies?
Yes: with start-ups, SMEs and corporations. The quote starts from your scope, so a small project stays small.

Want to know how many people would open a dangerous email?

Describe the scope; we reply with a quote within one business day.

Request a quote →