Phishing Simulation
Realistic, measured phishing campaigns that mirror what your staff actually receive — testing click and credential-entry rates so you can target awareness where it's needed.
What is Phishing Simulation?
Realistic phishing is the only honest way to measure click and credential-entry rates. We run campaigns themed to your industry and current lures, then report who clicked, who entered credentials and who reported — so awareness effort lands where it's needed.
You can't improve what you don't measure, and phishing is no different. A realistic simulation, themed to your industry and current lures, gives you hard numbers — click rate, credential-entry rate, reporting rate — instead of a hopeful assumption that training worked. Run once, it's a baseline; run regularly, it's a trend line that shows whether your awareness program is actually reducing risk.
A phishing simulation also builds a muscle that matters more than any single metric: reporting. An organisation where people confidently flag suspicious email detects real attacks faster, because the first person to report buys time for everyone else. We measure and encourage that behaviour, not just the click rate, so simulations make you demonstrably harder to breach.
Phishing Simulation is a manual, exploit-driven assessment: real people attacking your target the way an adversary would, then proving each finding with a working proof of concept. It is not an automated scan with a logo on it — the point is to find and demonstrate the issues that actually put you at risk, and hand your team a clear plan to fix them.
Why it matters
Real adversaries don't follow a checklist — they pursue an objective and adapt. Testing controls in isolation tells you nothing about whether your people and detection would actually stop an intrusion in progress.
A phishing simulation engagement replaces guesswork with evidence. Instead of hoping your controls hold, you get a ranked, reproducible picture of where they don’t — before someone hostile finds the same gaps.
Industries & use cases
Phishing simulation suits every organisation with email, and is often a compliance and cyber-insurance expectation for finance, healthcare and professional services.
What we test
Manual, exploit-driven coverage focused on real impact — not scanner noise.
- Realistic pretext design
- Click and open-rate measurement
- Credential-capture landing pages
- Attachment and payload testing
- Reporting-rate measurement
- Awareness recommendations
Signs you should run a phishing simulation
If any of these apply, testing is overdue.
- You want hard numbers on human risk
- Your awareness training is unproven
- Compliance or insurance expects simulations
- You've had phishing-related incidents
- You want to track improvement over time
Common vulnerabilities we find
The issues that show up again and again in phishing simulation — and the ones that actually get exploited.
High click rates
Staff opening and acting on convincing lures.
Credential submission
Users entering passwords on the simulated landing page.
Poor reporting
Few recipients flag the message to security.
No easy reporting path
Staff who spot a phish have no simple way to report it, so attacks that fail on one person still succeed on another.
Repeat clickers
A small group accounts for most risky clicks and needs targeted follow-up.
Low reporting confidence
Staff unsure whether or how to report, so real phish spread.
Susceptibility to targeted lures
Higher click rates on well-crafted, department-specific themes.
Gaps in technical filtering
Lures that reach inboxes your filters should have caught.
Example attack chain
Real impact rarely comes from one bug — it comes from chaining several. A representative example:
Why choose webhook.press
Attacker mindset
We’re offensive security people who also build the free tools bug-bounty hunters use daily. We test the way real adversaries do — and prove it.
No scanner theatre
You get findings a human exploited and verified, ranked by real business risk — not an unfiltered tool dump padded to look thorough.
Fixed price, free retest
A clear quote after scoping, a report your team and auditors can use, and a free retest to confirm the fixes hold.
Our methodology
A structured, transparent process aligned to OWASP and PTES — with a named point of contact throughout.
Scoping & rules of engagement
We agree the exact targets, depth, timing and constraints for your phishing simulation, and set clear rules of engagement so testing is safe and predictable.
Reconnaissance & mapping
We enumerate the full attack surface — endpoints, roles, technologies and trust boundaries — and threat-model where an attacker would focus.
Manual testing & exploitation
We attack by hand, verifying and chaining weaknesses into real impact. Automated tooling supports coverage; humans find the logic and authorization bugs it can’t.
Analysis & risk rating
Each finding is validated, rated by real business risk rather than raw scanner severity, and de-duplicated so you get signal, not noise.
Reporting
You receive an executive summary for leadership and a technical section with reproducible PoCs, evidence and concrete, stack-specific remediation.
Free retest
After you remediate, we re-test the closed findings to confirm they are actually fixed — at no extra cost.
What you get
Reproducible PoCs
Every finding ships with a working proof and step-by-step reproduction your engineers can replay and verify.
Risk-ranked findings
Prioritised by real business impact, so you fix what matters first instead of drowning in low-severity noise.
Actionable remediation
Concrete, stack-specific fixes and guidance — not generic “apply best practice” filler.
Free retest
We re-check the closed findings after remediation and confirm they’re resolved.
The report is written for two audiences at once: an executive summary that a non-technical stakeholder can act on, and a detailed technical section — findings, evidence, CVSS and reproduction — that your developers and auditors can use directly.
Manual testing, not just a scan
Automated scanners are fast and useful for coverage, but they only find patterns they already know, and they flood you with false positives. They cannot understand your business logic, chain several small issues into a breach, or tell you which alert actually matters. Our phishing simulation is led by experienced testers who exploit findings by hand and rank them by the damage they’d really do — the difference between a 300-page tool dump and a short list of things worth fixing.
Standards & compliance
Our phishing simulation reports are written to support the frameworks your auditors and customers care about — including SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and the EU’s NIS2 and DORA. Each engagement produces clear, independent evidence of testing with scope, methodology and findings documented the way assessors expect, so the same test both hardens your systems and helps satisfy your obligations.
Frameworks we follow
Recognised methodologies, adapted to your target — never a rigid checklist.
- OWASP — Web Security Testing Guide, ASVS and the API Security Top 10
- PTES — the Penetration Testing Execution Standard
- NIST SP 800-115 — technical guide to security testing
- OSSTMM — Open Source Security Testing Methodology Manual
- MITRE ATT&CK — to frame real-world adversary techniques
FAQ
How real are the emails?
As realistic as your real threats — themed to your industry and current lures, within agreed ethical bounds.
One-off or ongoing?
Both — a baseline campaign or a recurring program to track improvement over time.
How realistic are the emails?
As realistic as your real threats, within agreed ethical bounds — themed to your sector and current attacker techniques.
One-off or ongoing program?
Both — a baseline campaign, or a recurring program to track improvement over time.
Do you measure reporting, not just clicks?
Yes — reporting rate is a leading indicator of resilience, so we track and encourage it.
Can you target specific departments?
Yes — themed campaigns per team reveal where risk and training needs concentrate.
How long does a phishing simulation take?
Most focused engagements run one to two weeks depending on scope; we agree the exact timeline during scoping.
Is a retest included?
Yes — after you remediate, we re-check the closed findings to confirm they’re fixed, at no extra cost.
How do you price it?
Per engagement, based on scope and depth — you get a fixed quote after a short scoping call. No cookie-cutter packages.
Why teams trust our phishing simulation
Aligned to recognised standards
Testing follows OWASP, PTES, NIST SP 800-115 and MITRE ATT&CK, and reports support SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NIS2 and DORA.
Every engagement includes
Reproducible PoCs, risk-ranked findings, concrete remediation, a named point of contact, a free retest, and a summary letter of attestation.
Confidential by default
Work is covered by an NDA, scoped with clear rules of engagement, and data is handled with care throughout — including residency requirements.
Sample report available on request — see our reporting format and depth before you commit. Ask for a sample →
Get a quote for Phishing Simulation
Tell us about the target — we’ll come back with scope and a fixed price. Manual, exploit-driven testing with reproducible proof and a free retest.