Phishing that
protects your people.
phishsim sends realistic phishing by email, SMS and voice — only ever with your written authorisation — then turns every click into a lesson with built-in security-awareness training. The attack and the antidote, in one self-hosted system you can fully audit.
Any mail system · never captures a password · attributable on demand
No simulation sends without an active, signed client authorisation on file. The panel refuses — and logs the refusal.
There is no database column for a captured password. A fake login records only that a form was submitted — never a keystroke.
Lures look like a real attacker's, but every tracking domain traces back to its campaign. is-this-us answers your blue team.
Every launch, authorisation and config change lands in an append-only trail. Accountable by construction.
Catch it. Then teach it.
Most tools either phish your staff or train them. phishsim does both, on one shared record of every person — so the moment someone slips becomes the moment they learn.
Simulate
Launch realistic, red-flagged lures across three channels and watch exactly who opens, clicks, hands over a password, or does the right thing and reports it.
- Email, SMS and voice phishing from one console
- Per-person tracking and a 0–100 risk score
- A teachable moment the instant someone clicks
- AI-assisted lure drafting — propose-only, human-approved
record
Train
Assign the built-in awareness course to the people who need it. Nine short modules and a graded final questionnaire — worked through on a private link, no login.
- Nine modules: phishing, vishing, passwords, data & more
- Knowledge checks with instant, specific feedback
- Graded questionnaire with a pass mark you set
- Completion and scores tracked per client
Attackers don't stop at email.
Neither do we.
Phishing over any mail system — Google Workspace, on-prem Exchange or a 365 tenant — via standard SMTP, or injected in-tenant through Microsoft Graph.
SMTP · 365 GraphSMS — smishing
Text-message lures with tracked links, sent through your SmileSMS gateway or direct via Esendex with your own registered sender ID.
SmileSMS · EsendexVoice — vishing
Automated calls through your PBX with a chosen caller ID and a script that invites a keypress — the voice equivalent of a click, scored the same way.
PBX · keypress = clickFrom authorisation to improvement.
Authorise
Record the client's signed authorisation. It scopes the channels and gates every send against it.
Simulate
Build a lure or let the assistant draft one, pick your recipients, and launch — together or on a schedule.
Teach
Anyone who clicks lands on an honest reveal that walks through the exact red flags they missed.
Train & measure
Enrol those who slipped on the course, and watch risk fall across repeat campaigns.
See phishsim run, end to end.
A short walkthrough on your own terms: a simulation, the teachable moment, and the training loop — in demo mode, with nothing sent to anyone.