Phishing Simulation
That Builds a Human
Firewall, Not Fear
Phishing attack simulation
Measure and Reduce Human Cyber Risk, Ethically
Most breaches start with a person being tricked. iSpyCyber runs realistic, ethical phishing simulations across email, SMS, voice and QR codes, then turns every click into a short learning moment. Powered by iefyx PSP, our AI-driven simulation platform, programmes show leadership exactly how human risk is falling over time.
Why organisations choose iSpyCyber
AI-powered realism
iefyx PSP creates relevant, context-aware scenarios that reflect the lures your people actually face.
Multi-channel
Email, SMS, voice and QR-code simulations mirror how real attackers reach staff.
Learning, not blame
Instant micro-training helps people improve without naming or shaming anyone.
Privacy respected
Employee data is handled under strict controls and agreed with HR and legal teams.
Human risk metrics
Click, report and repeat rates tracked by team, role and location.
Continuous programme
Regular campaigns build lasting habits rather than one-off awareness.
Coverage
What a Phishing Programme Covers
Campaigns are designed with your security, HR and communications teams to reflect realistic risks and your culture.
Email phishing
Realistic but safe emails that test whether staff spot and report suspicious messages.
SMS phishing
Simulated text-message lures that reflect the growing risk on mobile devices.
Voice phishing
Authorised simulated calls that test verification habits for sensitive requests.
QR-code phishing
Simulated QR lures in email and print that test awareness of this newer channel.
Business email compromise
Scenarios that test verification of payment and data requests.
Targeted roles
Tailored campaigns for executives, finance, HR and IT teams who face greater risk.
Reporting behaviour
How quickly and reliably staff report suspicious messages to your security team.
Just-in-time training
Short, relevant lessons delivered at the moment someone needs them.
Human risk reporting
Trends by team, role and location that show where to focus effort.
Methodology
An Ethical Six-Phase Programme
Aligned to recognised awareness practice and designed with your HR, legal and communications teams from the start.
- NIST SP 800-50
- ISO/IEC 27001 A.6.3
- CIS Control 14
- DPDP Act 2023
- GDPR
2–3
weeks to launch a programme
6
ethical, structured phases
100%
campaigns approved before launch
01
- Week 1
Plan and agree
Goals, audiences, channels and ethical guidelines agreed with security, HR and legal stakeholders.
Key activities
- Agree goals and audiences
- Set ethical and privacy guidelines
- Confirm approvals and communications
- Output: Approved programme plan
02
- Weeks 1–2
Baseline
An initial campaign establishes a human risk baseline.
Key activities
- Run a baseline simulation
- Measure click and report rates
- Identify higher-risk groups
- Output: Baseline risk report
03
- Weeks 2–3
Design campaigns
iefyx PSP helps create realistic, relevant scenarios, which you approve before launch.
Key activities
- Create scenarios with iefyx PSP
- Tailor by role and channel
- Approve every campaign
- Output: Approved campaign set
04
- Ongoing
Launch and teach
Campaigns run on a natural schedule, with instant micro-training for anyone who clicks.
Key activities
- Send scheduled simulations
- Deliver just-in-time training
- Encourage and track reporting
- Output: Campaign results
05
- Monthly or quarterly
Measure and report
Human risk trends reported to leadership, with focus areas for the next cycle.
Key activities
- Track click, report and repeat rates
- Compare against baseline
- Brief leadership
- Output: Human risk report
06
- Each cycle
Refine and repeat
Campaigns and training adapt to results and emerging threats.
Key activities
- Adjust difficulty and focus
- Add new threat scenarios
- Recognise improving teams
- Output: Updated programme plan
Effort distribution
Where the programme time goes
Most effort goes into designing relevant campaigns and helping people learn from them. Percentages are indicative.
Quality built into every phase
Approved campaigns
Nothing launches without your sign-off.
Privacy by design
Employee data handled to agreed rules.
No blame culture
Learning comes before metrics.
Progress proven
Trends show real behaviour change.
Engagement models
Choose the Programme That Fits Your Organisation
Every option uses the same ethical approach and reporting. The difference is frequency, channels and how much we manage.
Baseline assessment
A one-off campaign to measure current human risk. Best for a starting point or audit evidence.
Managed programme
We design, run and report on regular multi-channel campaigns with iefyx PSP. Best for continuous improvement.
Platform with expert support
Your team runs iefyx PSP with our specialists advising. Best for teams that want control in-house.
Not sure which programme you need?
Our specialists will recommend an approach based on your workforce, culture and compliance needs.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear human risk insight for leadership, practical detail for security teams and evidence your auditors can rely on.
Executive summary
Objectives achieved, business impact and resilience themes in plain language for leadership and boards.
Engagement timeline
A clear, timestamped narrative of the exercise mapped to MITRE ATT&CK, alongside what was detected and when.
Improvement roadmap
Prioritised recommendations across people, process and technology, highest-impact actions first.
Validation report
Follow-up confirmation that agreed improvements work, ready to share with leadership and auditors.
Supports your compliance and assurance requirements
- ISO/IEC 27001
- NIST CSF 2.0
- CIS Controls v8
- PCI DSS
- SOC 2
- DPDP Act 2023
- GDPR
- RBI guidelines
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
Phishing simulation for every industry
The basics
What is a phishing attack simulation?
It is a controlled, ethical exercise that sends realistic but harmless phishing messages to staff, measures how they respond and provides instant training to build safer habits.
Is phishing simulation ethical?
Yes, when done properly. Every campaign is approved in advance, avoids distressing themes, respects employee privacy and focuses on learning rather than blame.
What is iefyx PSP?
iefyx PSP is iSpyCyber’s AI-powered phishing simulation platform. It helps create relevant scenarios, delivers just-in-time training and reports human risk trends.
Working with us
Which channels can you simulate?
Email, SMS, voice calls and QR codes, so your programme reflects the ways real attackers target people today.
How do you handle employee data?
Employee data is used only for the programme, protected under agreed controls and shared at the level of detail you approve with HR and legal teams.
How often should we run campaigns?
Many organisations run campaigns monthly or quarterly. Regular, varied simulations build lasting habits better than a single annual test.
Get started
Turn Your People
Into Your Strongest Defence.
Talk to our specialists about an ethical phishing simulation programme powered by iefyx PSP.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries