Why crews go after people.
Controls don’t stop a phone call
Technical controls don’t stop a convincing call to your finance team.
It works
People are consistently the most exploited way into a business.
Training isn’t proof
An awareness course tells you people were trained. A test tells you whether it stuck.
How the job runs.
Research
We build scenarios from what an outsider could learn about your people, processes and suppliers.
Run it
Emails, phone calls or both, agreed with you in advance.
Debrief
Who clicked, who called back, who reported it, and the specific training gaps.
Run it again
A follow-up campaign shows whether the changes worked.
When to call us.
- After rolling out security awareness training
- After a real phishing incident
- As part of a red team
- When an auditor or insurer asks for evidence of controls on people
On its own or all year?
Every year-round plan includes a phishing campaign. Phone-based testing can be added.
Partners: A campaign after a client’s training rollout shows whether it worked and opens further training and process work. Sell it under your brand.
Questions.
Do you test phone calls as well as email?
Yes. Calls to finance, the service desk or reception can be part of any campaign, and we agree the scenarios with you first.
What do we get at the end?
A debrief on what happened, where the gaps are and what to change, written so it can go straight into your training plan.
Find out who holds the door.
Tell us the size of the business and a technical account manager will plan the campaign with you.