Email. SMS. Voice. Real Threats.
Real Behavior Change.
Most platforms simulate phishing emails and call it multi-vector training. Ours deploys realistic email campaigns, smishing texts, and live vishing calls — all generated from active threat intelligence feeds updated weekly — with AI that adjusts difficulty per individual automatically, so every employee is always challenged at the right level to learn.
Three Attack Vectors. One Unified Platform.
Attackers do not limit themselves to email. Neither does our simulation engine. Your team trains against the same multi-channel social engineering that real threat actors use today.
Email Phishing Simulations
Campaigns built from templates sourced directly from PhishTank and URLhaus — the same live threat feeds analysts monitor. Templates include spear-phishing with harvested employee data, BEC / CEO fraud, invoice scams, IT help-desk impersonation, credential harvesting pages, and QR code phishing. Click tracking with geo and device telemetry. Immediate teachable-moment feedback on engagement.
SMS Smishing Simulations
Automated smishing campaigns delivered to employee mobile numbers with delivery capacity exceeding 50,000 texts per year. Scenarios cover package delivery fraud, bank account alerts, IT security notices, and executive urgent requests. Response tracking captures link clicks, information submissions, and reply rates — all analyzed per individual for risk scoring.
Voice Vishing Simulations
Automated vishing calls with interactive IVR interaction — capacity of 500+ calls per year. Scenarios simulate IT support fraud (requesting credentials), bank security department calls, government agency impersonation, and executive assistant pretexting. Tracks whether employees provided information, hung up immediately, or followed procedure. Every response scored and fed into individual risk profiles.
AI Adaptive Difficulty
Every employee operates in a personalized “Goldilocks zone” — simulations automatically calibrated on a 1 to 10 difficulty scale based on their individual performance history. Employees who rarely click receive more sophisticated spear-phishing. Repeat clickers receive simpler, more recognizable scenarios with immediate reinforcement. No static templates that experienced users learn to ignore.
Instant Micro-Training
The moment an employee engages with a simulation — clicks a link, submits credentials, or responds to a vishing call — they receive a 2 to 3 minute contextual micro-training module explaining exactly what they missed and why. Learning happens at the moment of maximum relevance, not at the end of a scheduled campaign. Five core micro-training scenarios matched to each attack type.
Gamification and Engagement
Badge system with earned recognition: Vigilant Guardian, Phishing Fighter, Perfect Score, Security Champion, and more. Department leaderboards and monthly team challenges with “zero clicks this month” and “100% completion” competitions. Individual streaks, achievement tracking, and rewards integration. Platforms using this model sustain voluntary completion rates above 80% without mandatory enforcement.
Individual Risk Scores. Department Benchmarks. Predictive Alerts.
Behavioral analytics build a risk profile for every employee based on simulation performance, training completion, repeat failures, and response patterns — updated in real time after every event.
What the Risk Engine Tracks
- ✓Simulation engagement rate by vector (email, SMS, voice)
- ✓Credential submission and information disclosure events
- ✓Micro-training completion rate after simulation engagement
- ✓Repeat failure patterns on the same attack scenario type
- ✓Training module completion and assessment score trends
- ✓Self-reported suspicious activity and correct reporting rate
Compliance Report Alignment
- ✓SOC 2 — Security awareness evidence for CC9 and CC2 controls
- ✓ISO 27001 — Annex A.7.2.2 training records with timestamps
- ✓HIPAA — 45 CFR 164.308(a)(5) workforce training documentation
- ✓PCI DSS v4.0 — Requirement 12.6 phishing awareness records
- ✓GDPR — Article 39 training compliance documentation
- ✓NIST CSF 2.0 — Awareness and Training (PR.AT) control evidence