Phishing Testing & Training
We don't just test — we train the people who fell for it. Every person who enters credentials gets a personal 1:1 session with a security expert. Not generic e-learning — a real conversation.
Across the industry, sustained phishing training takes click rates from about a third of staff down to roughly one in twenty-five within a year.
Source: KnowBe4 industry benchmark.
Service Tiers
Essential
Pre-built phishing formats customized via OSINT. Credential harvesting + 1:1 training + group debrief.
- 1 sending domain
- 1-2 days training
- 5 day delivery
Advanced
Everything in Essential + spear-phishing on specific individuals + multiple sending domains.
- Multiple sending domains
- 2-3 days training
- 10 day delivery
Premium
Full spectrum: BEC, quishing, vishing, smishing. C-suite coaching + finance team workshop.
- All attack vectors
- 3 days training
- 15 days + domain aging
Black Box option available — we receive zero information, just like a real attacker. (+30-50% scope modifier)
What's Included
Realistic Phishing Campaigns
OSINT-driven scenarios: Google/Teams invitations, M365 document sharing, HR updates, password resets. Credential harvesting on every campaign.
1:1 Personal Training
10-15 minute session with every person who submitted credentials. Supportive tone — education, not punishment. 30-40 people per day capacity.
Group Debrief
5-step format: positive atmosphere, phishing email review, "what made you click?" discussion, aggregated results, and what to do next time.
Comprehensive Report
Click-through rate, credential submission rate, reporting rate, time-to-click. Per-department breakdown with KPI trends.
SpearPhishing (Advanced+)
Targeted attacks on specific individuals based on deep OSINT. Multiple sending domains for higher delivery rates.
BEC & Full Spectrum (Premium)
Business Email Compromise, quishing (QR), vishing (voice), smishing (SMS). C-suite coaching and finance team workshops.
How It Works
01
Scoping & Authorization
We receive the signed authorization, target list (emails, names, departments), and agree on testing parameters.
02
OSINT & Scenario Design
We research your organization and design realistic phishing scenarios tailored to your industry and culture.
03
Campaign Execution
Phishing emails deployed with real-time monitoring. Credential harvesting landing pages track who clicked and who submitted.
04
1:1 Training Sessions
Every person who submitted credentials gets a personal training session — remote or on-site, supportive and educational.
05
Group Debrief & Report
Interactive group session reviewing the phishing email together. Final report with all KPIs, per-department analysis, and recommendations.
Who Needs This
- CISO / Security Manager
- IT Manager
- HR (compliance-driven training)
- Companies preparing for NIS2/DORA
- Organizations after a real phishing incident