Loading…
Services · Tech
Phishing simulation and staff training
Send your own team realistic phishing emails, see who clicks, and train the ones who do. Insurers increasingly ask whether you do this.£5 to £7/user/month
What phishing simulation and staff training actually means
Phishing simulation is training your team by safely doing to them what a real attacker would. We send your own staff realistic but harmless phishing emails, using the same tricks criminals are using this month, and see who clicks, who enters a password, and who spots it and reports it. Nobody is caught out publicly; the point is to find the gaps while it is safe, not to embarrass anyone.
When someone does click, they do not get a telling-off, they get a short, specific piece of training right at that moment, while the mistake is fresh and the lesson lands. Over a few rounds people learn to recognise the shape of these emails, and the ones who used to click reliably stop. We measure a baseline click rate first, so the improvement is a real number you can see, not a feeling.
This exists because almost every serious breach starts with a person, not a broken machine. The firewall did its job; someone was simply persuaded to open the door. That is not stupidity, it is human, and it is precisely the thing no piece of software can fully protect against. Training the people is the only real defence for the attack that targets people, and it is the cheapest security spend most businesses can make.
See it work
Rather than take our word for it
Can you spot the fake? Click the parts of this email that look wrong.
From: Microsoft 365 <>
Subject: Your password expires today
,
Our records show your password will expire. You must verify your account .
Confirm here:
You found 0 of 5 red flags
- Hidden, click a suspicious part of the email
- Hidden, click a suspicious part of the email
- Hidden, click a suspicious part of the email
- Hidden, click a suspicious part of the email
- Hidden, click a suspicious part of the email
A scripted demonstration using a made-up email. In a real phishing simulation we send safe test emails to your team and report, privately, who needs a hand.
How it helps your business
The direct benefit is fewer people falling for the real thing. A team that has seen dozens of realistic fakes in training catches the genuine one on a Tuesday afternoon, because it looks familiar. Given that a single click can lead to drained accounts, a fraudulent payment or ransomware across the network, turning your staff from the weak point into an alert first line is enormous value for a few pounds a head.
It also gives you the evidence insurers and auditors increasingly want. Cyber-insurance renewals now routinely ask whether you run staff security training, and being able to show monthly reports with a falling click rate is the difference between a smooth renewal and an awkward one. It demonstrates you take this seriously, which is exactly what they are checking.
And it changes the culture quietly. When reporting a suspicious email is normal and rewarded rather than ignored, people flag things, and one person spotting and reporting a live phishing campaign can protect everyone else before it spreads. That instinct, spread across a team, catches attacks that would sail straight past any individual, and it is the part of safety only people can provide.
What is included
- Realistic campaigns using current techniques, not obvious fakes
- Short training that triggers automatically when somebody clicks
- Monthly reporting you can show an insurer or an auditor
- Baseline click rate measured first, so improvement is provable
Real examples
Illustrative cases. Tap one to see what happened and what could have been done.
The click rate that fell off a cliff
The case
A forty-person insurance broker started with almost a third of staff clicking the first simulated phish and several handing over a password, so a real attack would very likely have landed.
What could have been done
A few months of realistic campaigns and short in-the-moment training drops the click rate into low single figures and lifts reports of suspicious emails, so when a genuine, well-crafted attack arrives later it is reported within minutes rather than clicked.
The report that saved the renewal
The case
A logistics company's cyber-insurance renewal hinged on evidence of ongoing staff security training, which they did not have.
What could have been done
Putting a simulation programme in place and handing over clean monthly reports showing a measured, improving click rate gets the renewal through at a sensible premium instead of loaded or refused, for less than the difference.
Ready to sort phishing simulation and staff training?
Tell us what is going wrong and we will come back with a fixed price in writing, after a short scoping call. No obligation, and no jargon.
Common questions about phishing simulation and staff training
How much does phishing simulation and staff training cost?
£5 to £7/user/month. We agree the exact number before any work starts, so there are no open ended day rates.
How long does phishing simulation and staff training take?
Most work of this kind is live within three to four weeks. We give you a date before we begin and tell you early if anything threatens it.
Do you work outside Edinburgh?
Yes. We are based in Edinburgh and work on site across the Lothians, Fife and Glasgow, and remotely across the United Kingdom.
Phishing simulation and staff training in your area
Same service, same prices, wherever you are. On site across central Scotland and remotely across the rest of the UK.
Phishing simulation and staff training in EdinburghPhishing simulation and staff training in LeithPhishing simulation and staff training in FifePhishing simulation and staff training in Livingston and West LothianPhishing simulation and staff training in GlasgowPhishing simulation and staff training in DundeePhishing simulation and staff training in Aberdeen and the north eastPhishing simulation and staff training in StirlingPhishing simulation and staff training in FalkirkPhishing simulation and staff training in Perth and PerthshirePhishing simulation and staff training in LondonPhishing simulation and staff training in ManchesterPhishing simulation and staff training in BirminghamPhishing simulation and staff training in LeedsPhishing simulation and staff training in LiverpoolPhishing simulation and staff training in SheffieldPhishing simulation and staff training in BristolPhishing simulation and staff training in Newcastle upon TynePhishing simulation and staff training in NottinghamPhishing simulation and staff training in LeicesterPhishing simulation and staff training in CoventryPhishing simulation and staff training in CardiffPhishing simulation and staff training in SwanseaPhishing simulation and staff training in BelfastPhishing simulation and staff training in SouthamptonPhishing simulation and staff training in BrightonPhishing simulation and staff training in ReadingPhishing simulation and staff training in Inverness
Related tech services
Cyber security audit
An honest, plain-English health check of how safe your business actually is, and a clear, prioritised list of what to fix first. The sensible first step before spending a penny on security.
AI audit
Find out what AI your staff are already using, what business data might be leaking into it, and whether any of it is safe, before it becomes a problem. Plain-English, no hype, no obligation.
VoIP and cloud telephony
Business phone systems that follow your team anywhere. Number porting, call routing, voicemail to email, and call recording where you need it.
Dialler systems
Predictive, progressive and preview diallers for outbound teams. Set up, tuned, and kept compliant with Ofcom rules on abandoned calls.
Transcription and call intelligence
Every call, meeting and voice note turned into searchable text, with summaries and actions extracted automatically. Accurate on strong regional accents.
Admin Rescue
Stop missing calls. Stop quoting at midnight.