Overview
We build campaigns around the lures UK staff actually receive, such as parcel delivery notices, HMRC refunds, Microsoft 365 alerts and supplier bank-detail changes. Results show who reports suspicious emails as well as who clicks, which is the behaviour you want to grow.
Phishing simulations show how your organisation would respond to a real attack: who clicks, who submits credentials, and — most importantly — who reports the email. Run regularly, they measurably reduce risk and build a reporting culture.
We design campaigns based on real lures our SOC sees — credential harvesting, fake invoices, delivery notifications, MFA prompts and executive impersonation — tailored to your industry and difficulty level. Users who fall for a simulation receive short, immediate training; users who report it are reinforced.
Campaigns are run ethically and transparently: no public shaming, sensible lure choices and clear communication with leadership and HR.
Awareness training built for UK staff
- Lures and examples UK employees really receive: HMRC, DVLA, parcel delivery, Microsoft 365 and invoice fraud
- Modules on handling personal data under UK GDPR and the Data Protection Act 2018
- Clear guidance on reporting suspicious emails, including forwarding them to the NCSC's Suspicious Email Reporting Service
- Completion records for ISO 27001, Cyber Essentials and customer audits
What's included
Our approach
- BaselineInitial campaign to measure current risk.
- PlanAnnual calendar of varied campaigns.
- RunSafe, controlled simulations.
- TeachInstant training and targeted follow-up.
- ReportTrends in click, submit and report rates.
What you receive
- Campaign calendar
- Per-campaign results
- Department-level risk insights
- Training follow-up for repeat clickers
- Quarterly human-risk report
Standards & frameworks
- NIST SP 800-50
- ISO/IEC 27001 A.6.3
- MITRE ATT&CK T1566
- SOC 2 CC2.2
- UK GDPR Art. 39 (awareness)
Frequently asked questions
Is phishing simulation ethical?
Yes, when run transparently with leadership approval, sensible lures and a focus on learning rather than punishment.
How often should we run simulations?
Monthly or quarterly campaigns of varying difficulty work well for most organisations.
What metric matters most?
The report rate — how many users report the phish — is often more meaningful than the click rate.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.
Can you support UK organisations from India?
Yes. All services are delivered remotely by our team in India. India is 4.5 hours ahead of UK time during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps with yours every morning and afternoon. Testing windows and escalation contacts are agreed around your UK schedule, and 24/7 services run around the clock.