Phishing simulation
Run controlled phishing exercises against your own staff, measure who clicks, and land them on a training page instead of an attacker. Built on the same campaign engine as marketing email, with an explicit consent gate on top.
- Read
- 7 min
- Module
- Phishing
Authorisation comes first
A phishing campaign cannot be sent until the workspace records an explicit authorisation: who approved the exercise, and against which population. This is not paperwork for its own sake — sending deceptive mail to people who have not consented, in an organisation you do not control, is the difference between an awareness programme and an attack.
Sender domains
A simulation needs a From address. Domains are registered under Security → Sender domains, verified by DNS, and issued a real DKIM keypair so the mail is signed and actually lands. Three modes cover the realistic range of exercises.
The lookalike generator
Given a legitimate domain, the generator proposes variants an attacker would plausibly register and shows what each one exploits. It is a research aid — registering and verifying the domain is still on you.
| Technique | Example against acme.com | What it exploits |
|---|---|---|
| Character swap | acnne.com | Fast reading of similar letterforms |
| Homoglyph (Cyrillic) | асme.com | Non-Latin glyphs that render identically |
| Typosquat | acme.co | Muscle memory and truncated TLDs |
| Subdomain bait | acme.com.login-secure.net | Readers who stop at the first familiar token |
| Hyphenation | acme-support.com | Assumed legitimacy of a department subdomain |
What a campaign measures
The funnel is deliberately narrow: opened, clicked, submitted. Each step is a stronger signal than the last, and the third one is what actually matters for training.
The training moment
Anyone who clicks lands on a training page explaining what the message did, which signals were present, and what to check next time. Teaching at the moment of the mistake is the entire point of the exercise — a report that names the people who failed, with no follow-up, produces resentment rather than resilience.