Turn your team into your strongest line of defence.

Phishing simulation is a controlled exercise where we send realistic but completely safe lookalike phishing emails to your staff to measure who clicks, who reports and who is most at risk. Rather than guessing at your human risk, you get hard, trackable data broken down by individual, team and the whole company, updated every month as campaigns run. It turns an abstract worry — would our staff fall for this? — into a concrete risk score you can act on, report to your board, and use as evidence for insurers or clients who ask how you manage phishing risk day to day.

We start with a baseline campaign to measure your current click rate, then run monthly simulations that gradually increase in sophistication, mirroring real attacker tactics such as invoice fraud, delivery scams and executive impersonation. Anyone who clicks lands on a friendly coaching page and completes a short training module in the moment, while managers see dashboards tracking click rates, report rates and repeat clickers by person, team and company-wide. Campaigns are tailored to your sector, so a finance team sees different lures to a manufacturer, and most SMEs are running their first campaign within a week of onboarding.

Around 9 in 10 successful cyber attacks start with a phishing email, and untrained staff click malicious links up to 30% of the time — trust alone doesn't change that number. No amount of firewall or antivirus spend fixes a person clicking a convincing link, because the attack targets judgement, not technology. Simulation combined with in-the-moment coaching is the only proven way to measurably bring that click rate down over time, and it gives you evidence of the improvement rather than a hope that training has sunk in.

Plans start from around £3 per user per month on a straightforward per-user subscription with no minimum contract, covering all campaigns, training content, dashboards and monthly reporting in one fee. There's no separate setup charge and no cost per simulated email sent, so you can run campaigns as often as makes sense for your team. We confirm final pricing once we understand your headcount, sector and any specific compliance requirements on a short scoping call, and pricing scales predictably as your team grows rather than jumping in large tiers.

Yes — any business with an email-using workforce benefits, regardless of size, and there's no minimum headcount to get started. Smaller teams often see the fastest improvement because coaching can be targeted directly at the small number of people who need it, and the cost per user stays modest even for a handful of staff. There's no dedicated administrator required either; campaigns run automatically once set up, new starters can be added easily, and a five-person office gets the same quality of simulation and reporting as a much larger organisation.

Trained teams typically see click rates fall from 25–30% down to under 5% within 6–12 months of regular simulation and in-the-moment coaching, alongside a noticeable rise in staff actively reporting suspicious emails rather than ignoring or clicking them. You also build a documented evidence trail of training activity that insurers, auditors and clients increasingly ask to see. Just as importantly, the improvement shows up in dashboards month by month, so you can demonstrate a genuine trend rather than relying on a single annual snapshot before renewal or audit.

Classroom sessions or annual e-learning test recall in an artificial setting and fade from memory within weeks, leaving staff no better prepared when a real phishing email lands months later. Simulation tests behaviour under realistic conditions, repeatedly, so the learning actually sticks and you get ongoing measurable data rather than a single tick-box completion record filed away and forgotten. It also catches new starters and behaviour drift automatically, rather than relying on everyone remembering a one-off session delivered at a different point in the year.

No — campaigns are deliberately framed as supportive coaching rather than punishment, and the messaging staff see when they click is designed to educate, not embarrass. Individual results are used to target private coaching where it's genuinely needed, while reporting to management is aggregated across teams, so no one is publicly named or shamed for clicking a well-crafted simulated email. Most staff come to see it as a helpful reminder rather than a trap, particularly once they understand it's protecting the whole business, including them personally.