For companies Phishing simulation & training
A realistic simulation, followed by a short training session based on the real cases from your organisation – and a second measurement that shows whether it worked.
- Who we serveBusinesses that want to make awareness measurable instead of handing out a tick-box video.
- The key figureNot the click rate but the reporting rate. A reported attack is an attack fended off.
- What you have afterwardsA comparison value after the second round and three to four rules that hold up in everyday life.
Phishing simulation & training
- Scenarios based on your actual suppliers and processes
- Multi-stage measurement: opened, clicked, data entered, reported
- Training of 60 to 90 minutes based on the real cases from the measurement
- Second simulation after a few weeks as a comparison value
- Evaluation as a metric for management, never as a list of names
How it works in practice.
Preparation
We research what an attacker finds about you and build credible scenarios from it.
Baseline measurement
The simulation runs. Measurement is multi-stage, not just the click.
Training
Short and concrete, with the messages from your own measurement instead of abstract examples.
Second round
The same measurement after a few weeks. Only the comparison shows the effect.
A forged message designed to get you to do something – usually click a link and enter credentials. Modern variants are linguistically flawless and refer to real events in your organisation.
A supposed message from management with an urgent request for a transfer, often combined with a request for confidentiality. It is precisely this combination of urgency and secrecy that gives it away.
We send a harmless but realistic phishing email to your team ourselves. Nobody is harmed, nothing is installed. We measure how many click – and how many report it.
A reported attack is an attack fended off. That is why the most important number is not how few click, but how many speak up. Evaluation is always anonymous, never by name.
What is included – and what explicitly is not.
Typical scope
20 to 200 recipients, two measurement rounds and one training session.
Duration
Around six to eight weeks from the first to the second measurement.
Prerequisite
Commission by management and approval by the works council, if there is one.
Not included
No individual evaluation, no permanent monitoring of email traffic.
Awareness reduces the likelihood; it doesn't eliminate the risk. It complements technical measures such as two-factor authentication rather than replacing them.
What people ask beforehand.
As a rule yes, if the evaluation is exclusively aggregated and no conclusions can be drawn about individuals. That is exactly how we set it up. Where there is a works council, it should be involved beforehand – we clarify this together with you.
No, that would be counterproductive. Anyone who falls for it receives factual, private feedback. Management receives a number. As soon as people are afraid of consequences, they stop reporting real incidents.
The click rate alone says little. What matters is the reporting rate and how it develops between the first and second round. An organisation in which 40 per cent report is better placed than one in which nobody clicks but nobody reports either.
More offers for you.
Security baseline check
The starting point for businesses that have never been tested: we look at your organisation from the outside and tell you in plain language where you stand.
Red team engagement
Building and network in one engagement: we try to get in – physically and digitally – and document every step.
Phishing simulation & training
A realistic simulation, followed by a short training session based on the real cases from your organisation – and a second measurement that shows whether it worked.
Access, POS and Customer Data Check
For studios with access outside staffed hours, practices, workshops and restaurants: we look at where people actually get to — and what is there.
What we encounter in assessments, before you encounter it.
Not a product newsletter. We write about attack paths that actually worked against Austrian businesses, authorities and schools – and what helps against them.
- About once a month, not every week
- Concrete attack paths from real assessments
- No tracking pixel, no sharing with advertisers
- Unsubscribe with one click in every email