Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
Phishing Simulation & Social Engineering
Find out who clicks before an attacker does.
A campaign built for your people, measured by who clicks, who submits, and who reports.
- Full company or whaling
- click / credential / report rates
- 2-4 weeks lead time
- from €900
This simulation can be booked on its own, or scheduled for you inside the Retained Security Partner retainer at the point where it adds the most.
The Challenge
Why phishing still works
Endpoint protection, multi-factor authentication and mail filtering have all moved on. Phishing is still the most common way into a company network, because the step it exploits is a person deciding that a message looks like ordinary work.
What AI changed
Perfect language
Clumsy grammar and odd phrasing were the tell most awareness training was built on. A model writes fluent, correctly formatted business English, German or Czech from a two-line brief, in the house style of whoever it is imitating.
A voice you recognise
A few minutes of a manager speaking at a conference or on a webinar is enough material to clone the voice. A payment request that arrives as a phone call now sounds like the person who would normally make it.
Tailored to each recipient
Public profiles, job adverts and press releases give one attacker enough material to write a specific pretext for every name on a list. Personalised phishing used to cost hours per target, and now it costs a prompt.
Where a simulation stops. One campaign measures where your people are today. Moving the report rate takes repetition, a debrief people can learn from, and a record of how the numbers change over time, which is the work a human risk management programme does.
Scope
What's in scope
A campaign sends one crafted pretext to the people you scope. Each recipient then does one of four things, and the campaign counts how many land in each.
The number that matters is the last one
One pretext email
Sent to the scoped employee list
Every recipient lands on one of these
Submitted credentials
Entered a password on the landing page
Credential submission rate
Clicked the link
Opened the page, went no further
Click rate
Did nothing
Ignored or deleted it, told no one
Silent majority
Reported it
Recognised the pretext and warned IT
Report rate
A click rate on its own tells you how convincing the pretext was. The report rate tells you whether anyone would raise the alarm during a real attack, which is the behaviour a simulation exists to build. Results come back per employee, and are anonymised in the executive report.
Requirements
Inputs we need from you
Names and email addresses. Nothing else is needed.
Full company, a specific department (finance, IT, management) or executives only (whaling). The choice sets both the pretext and the price.
Whitelisting makes sure every employee receives the email, so the results measure what people do. It takes your IT team about five minutes.
Individually written emails get through normal email protection on their own.
What you get back
Two documents, from the same campaign data.
The four outcome rates for the campaign, anonymised, with how they compare to what we see elsewhere and what to do about the gap.
Named results for whoever owns follow-up internally, with timestamps. Handle it under your own HR and works-council rules.
A short session walking your people through the pretext and the tells they missed. This is where the report rate starts moving.
Pricing
Indicative pricing
What affects the final price
Number of Targets
Campaigns run from a handful of executives to the whole company, and more recipients mean more setup and tracking.
Realism Level
A generic pretext costs less than one researched from public sources to mimic your internal tools. Whaling needs individual research on each executive.
Lead Time saves money
Plan 2-4 weeks ahead. Research and setup are what make the email credible to your own staff.
Process
How We Collaborate
We agree the target group, the campaign goals and the pretext, generic or researched. Usually 30 minutes.
Technical setup and, for targeted campaigns, research on the recipients from public sources.
The emails go out on the agreed schedule, and clicks, credential submissions and reports are tracked as they happen.
You receive the results report with click, credential-submission and report rates, plus a summary for management. The report rate shows how many people raised the alarm.
Get started
Scope a campaign
For regular testing on a monthly fee, see the Retained Security Partner retainer.