Overview
We build campaigns around the lures US employees actually receive, such as package delivery notices, fake IRS or benefits messages, Microsoft 365 alerts, e-signature requests and vendor bank-detail changes. Results show who reports suspicious emails as well as who clicks, which is the behavior you want to grow.
Phishing simulations show how your organization would respond to a real attack: who clicks, who submits credentials, and — most importantly — who reports the email. Run regularly, they measurably reduce risk and build a reporting culture.
We design campaigns based on real lures our SOC sees — credential harvesting, fake invoices, delivery notifications, MFA prompts and executive impersonation — tailored to your industry and difficulty level. Users who fall for a simulation receive short, immediate training; users who report it are reinforced.
Campaigns are run ethically and transparently: no public shaming, sensible lure choices and clear communication with leadership and HR.
Awareness training built for US staff
- Lures US employees really receive: IRS and benefits scams, package delivery, payroll and e-signature requests
- Wire-fraud and payment-change verification drills for finance and accounts payable teams
- Modules on handling health, financial and personal data under HIPAA, GLBA and state privacy laws
- Completion records for SOC 2, HIPAA, PCI DSS and customer audits
What's included
Our approach
- BaselineInitial campaign to measure current risk.
- PlanAnnual calendar of varied campaigns.
- RunSafe, controlled simulations.
- TeachInstant training and targeted follow-up.
- ReportTrends in click, submit and report rates.
What you receive
- Campaign calendar
- Per-campaign results
- Department-level risk insights
- Training follow-up for repeat clickers
- Quarterly human-risk report
Standards & frameworks
- NIST SP 800-50
- ISO/IEC 27001 A.6.3
- MITRE ATT&CK T1566
- SOC 2 CC2.2
- PCI DSS 12.6
Frequently asked questions
Is phishing simulation ethical?
Yes, when run transparently with leadership approval, sensible lures and a focus on learning rather than punishment.
How often should we run simulations?
Monthly or quarterly campaigns of varying difficulty work well for most organizations.
What metric matters most?
The report rate — how many users report the phish — is often more meaningful than the click rate.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.
Can you support US organizations from India?
Yes. All services are delivered remotely by our team in India. India is 9.5 hours ahead of US Eastern time during US daylight saving time (10.5 hours in winter) and 12.5 to 13.5 hours ahead of Pacific time. Meetings and testing windows are agreed around your US time zone at scoping, and 24/7 services run around the clock.