[email protected]
Home› Security Awareness› Phishing Simulations
Phishing & Social Engineering Simulation

Find out who clicks
before an attacker
does it for you

Realistic, targeted phishing campaigns that benchmark your organization's susceptibility, identify your highest-risk employees, and track measurable improvement over time.

Launch a Campaign How it works
23%
Avg initial click rate
↓74%
Risk reduction after 90 days
6+
Simulation types
📥 Inbox — [email protected] Campaign live
All (6) Flagged (3) Reported (1)
2
Clicked
1
Reported
1
In training
Overview

The only way to know is to test

Your employees may believe they'd recognize a phishing email. Our simulations find out — without the credential theft, ransomware deployment, or wire fraud that would follow a real attack. We run realistic, carefully crafted campaigns that mirror the exact tactics threat actors use against organizations like yours.

We don't just send a generic "you've been phished" landing page. Employees who click receive immediate, contextual training in the moment — when the lesson is most impactful. Each campaign produces department-level and individual-level data so you know exactly where your human risk is concentrated.

Over time, repeat campaigns track measurable improvement. That data satisfies auditors, reduces cyber insurance premiums, and gives your leadership team real evidence that your security culture is improving.

23%
Average initial click rate across organizations
↓74%
Avg click rate reduction after 90-day program
82%
Of breaches involve a human element — Verizon DBIR
Every campaign includes
Full-scope phishing
simulation program
Custom template design
Lures crafted for your industry, your tools, and real organizational context — not off-the-shelf templates
Randomized wave delivery
Campaigns sent in staggered waves to prevent word spreading and ensure unbiased results
Full behavior tracking
Opens, clicks, credential submissions, and — critically — who reported the phish to your security team
Just-in-time training
Employees who click are immediately served contextual training modules — in the moment, not a week later
Department-level reporting
Results broken down by department, role, and location — so you know where risk is concentrated
Trending benchmarks
Campaign-over-campaign trend data showing measurable improvement — ready for auditors and insurers
Simulation Types

Every vector attackers use

Phishing has evolved far beyond suspicious emails. We simulate the full range of social engineering vectors your employees face — from AI-crafted spear phishing to vishing calls.

Email
Credential Harvesting
Fake login pages for tools your employees use daily — Microsoft 365, Google Workspace, Salesforce, Okta. Measures who enters credentials on a lookalike login page.
M365 luresGoogle WorkspaceSSO portals
Email
Spear Phishing
Targeted emails crafted using OSINT about specific employees — referencing their role, their manager, recent company announcements, or industry-specific context. Significantly harder to spot.
OSINT-drivenRole-targetedExecutive-level
Email
Business Email Compromise
CEO, CFO, or vendor impersonation requesting urgent wire transfers, payroll changes, or gift card purchases. Tests whether financial and HR teams follow proper verification procedures.
CEO fraudVendor impersonationFinance teams
Email
Malicious Attachment
Simulated attachment lures — fake invoices, HR policy documents, shipping notifications, and shared drive links — that measure whether employees open files from unknown or suspicious senders.
Fake invoicesHR docsMacro-enabled
Voice
Vishing
Simulated phone calls from fake IT support, banks, or vendors attempting to extract credentials, MFA codes, or sensitive data verbally. Tests resistance to real-time social pressure.
IT impersonationMFA bypassHelpdesk fraud
SMS
Smishing
Text-message-based phishing simulations testing employee behavior on personal and corporate devices — package delivery fraud, IT alerts, and two-factor authentication interception attempts.
Delivery fraudMFA interceptionMobile devices
Process

How a campaign runs

From scoping to final report, a typical campaign runs in three to four weeks. We handle everything — template design, technical infrastructure, delivery, tracking, and triggered training.

Scoping
We agree on target groups, simulation types, difficulty level, and any exclusions — executives, board members, specific departments.
Template Design
Custom lures crafted using your company's branding context, tool stack, and real OSINT — not recycled generic templates that employees recognize immediately.
Wave Delivery
Emails sent in randomized waves over 48–72 hours so employees can't warn each other, results aren't skewed, and the campaign mirrors real attack behavior.
Live Tracking
Real-time dashboard showing opens, clicks, credential entry, and reports — with just-in-time training modules automatically triggered for employees who interact.
Report & Benchmark
Full results by department, role, location, and individual — with trending data across repeat campaigns and compliance-formatted evidence packages.
Reporting & Analytics

Data your leadership can act on

A phishing campaign is only valuable if the data it generates drives decisions. Every campaign produces a structured report showing exactly where your human risk is concentrated — by department, seniority, location, and simulation type.

We track not just who clicked, but who reported the phish through your security team's reporting channel — a critical signal that's often ignored. A high reporting rate is just as important a metric as a low click rate. It tells you whether your security culture is working.

Campaign-over-campaign trending
Click rates, reporting rates, and credential submission rates tracked across every campaign — showing measurable improvement your board can see.
Department & role-level breakdown
Results segmented by department, manager, seniority level, and location — so training resources are directed where risk is highest.
Compliance-formatted evidence
Report packages formatted for PCI-DSS, SOC 2, ISO 27001, HIPAA, and cyber insurance carrier requirements — delivered alongside every campaign.
High-risk employee identification
Employees who interact with multiple campaigns are flagged for enhanced training — before they become the entry point for a real attack.
Campaign results — 90-day program
Week 1
68% clicked
Month 1
42% clicked
Month 2
23% clicked
Month 3
8% clicked
High risk
Elevated
Moderate
Low risk
↓88%
Click reduction
↑4x
Report rate
148
Employees trained
3
High-risk flagged
Compliance

Satisfy auditors and insurers

Phishing simulation programs are increasingly required or strongly incentivized by compliance frameworks and cyber insurance carriers. Our reports are built to satisfy those requirements out of the box.

PCI-DSS v4
Requirement 12.6 mandates security awareness training including phishing recognition for all applicable personnel
SOC 2 Type II
Phishing simulation evidence supports security training controls in the CC2 and CC9 trust service criteria
HIPAA
Required workforce training on recognizing phishing under the HIPAA Security Rule administrative safeguards
ISO 27001
Annex A.6.3 requires awareness, education, and training programs covering social engineering and phishing
Cyber Insurance
Most carriers now require documented phishing programs and offer premium reductions for regular simulation campaigns
NIST CSF
Identify and Protect functions include workforce awareness training and social engineering resistance
What you receive
Full campaign results report with per-employee, department, and org-level metrics
Click rate, credential submission rate, and phish-reporting rate breakdowns
Executive summary suitable for board and leadership presentation
High-risk employee identification and remediation recommendations
Campaign-over-campaign trend data for repeat engagements
Compliance evidence package (PCI, SOC 2, HIPAA, ISO 27001)
Just-in-time training completion records for every employee who clicked
Why Radical Security

The Radical difference

We're an offensive security firm — the people who run phishing campaigns as part of red team engagements. Our simulations aren't based on what compliance checklists say phishing looks like. They're based on what attackers actually send.

Attacker-built templates
Our lures are crafted by the same engineers who conduct real phishing campaigns during red team assessments — not stock templates from a library. Your employees train against realistic threats.
Reporting rate matters
Most vendors only track who clicked. We track who reported the phish too — because building a culture where employees report suspicious emails is just as important as teaching them not to click.
Contextual, not punitive
When an employee clicks, they receive immediate, helpful training — not a "gotcha" message. The goal is behavior change, not creating anxiety about using email.
Integrated with real testing
Phishing simulations run alongside our pentest and red team work — combining technical attack findings with human risk data into a single unified picture of your actual exposure.

Ready to find out who clicks?

Tell us about your organization and we'll design a phishing campaign scoped to your risk profile, your tools, and your compliance requirements.

Request a Campaign Consultation
No commitment required.
Explore More

Related programs

Security Awareness Training
Role-based training modules that teach employees to recognize phishing, social engineering, and insider threats.
Tabletop Exercises
Facilitated incident response simulations that test your team's decision-making under real crisis conditions.
Penetration Testing
Technical testing of your infrastructure — pairing well with phishing simulation to cover both human and technical attack surfaces.
Virtual CISO
Strategic security leadership to build the ongoing security awareness program phishing simulations feed into.