Phishing simulation
Phishing simulation campaigns
Most breaches still start with an email. We send realistic, tailored phishing campaigns to your staff and show you who clicked, who entered credentials and, most importantly, who reported it.
Who it is for
- Organisations that want to measure security awareness, not just train it
- Teams that need evidence for cyber insurance, ISO 27001 or client audits
- Businesses that have had a phishing incident and want to know if it could happen again
- MSPs running ongoing awareness programmes for their clients
What we cover
Tailored lures
Pretexts based on your real suppliers, tools and news, not the generic templates staff have learned to spot.
Credential capture
Convincing login pages that measure who would hand over their password. We record that a password was entered, not the password itself.
Attachments & links
Harmless tracked documents and links that show what would have run if the email had been real.
MFA bypass
Where agreed, we test whether modern adversary-in-the-middle phishing could get past your MFA.
Reporting culture
How many staff report the email, how quickly, and how your IT or security team responds.
Trends over time
Repeat campaigns with varied difficulty so you can see real improvement, not one-off numbers.
How it works
Scope
We agree the audience, the type of lures, timing and the allowlisting your IT team needs to set up.
Build
We research your organisation, build the emails and landing pages, and test delivery before launch.
Send
Emails go out in staggered batches so word does not spread, and we monitor the campaign live.
Report
Clear results and practical recommendations, with a debrief on what to change first.
What you get
- Campaign report with open, click, credential entry and report rates
- Results broken down by department or role
- Copies of every lure and landing page used
- Recommendations on email filtering, MFA and reporting tools
- Optional training page shown to staff who click
- Trend comparison across repeat campaigns
Frequently asked questions
Can't find your answer? Ask in the form below and we will get back to you as soon as we can.
Will you name and shame staff who click?
No. By default we report by department or role, not by name. Phishing simulations work best when people feel safe to report mistakes. If you need individual results, we agree how they will be handled up front.
Do we need to allowlist your emails?
Usually yes. A small allowlist in Microsoft 365 or Google Workspace means we measure your people, not your spam filter. If you want to test the filter as well, we can run a separate set of emails without allowlisting.
How often should we run campaigns?
Quarterly is a good starting point for most organisations. It is frequent enough to build habits and show trends, without causing fatigue. Larger or higher-risk organisations often move to monthly.
Can you test whether attackers could bypass our MFA?
Yes. Where agreed, we can use adversary-in-the-middle techniques that capture session tokens as well as passwords. It is one of the most common ways real attackers get past MFA today.
Get a fixed quote
A few quick questions so we can scope it properly. No obligation, no hard sell.
Thanks, we have your enquiry.
We will reply as soon as we can. If it is urgent, email hello@redstackd.com.