Phishing simulation and security awareness training

Many phishing tools ship pixel-perfect copies of well-known login emails. Infronest deliberately does not: campaign templates are generic lures — a password-expiry notice, a parcel delivery update, an invoice attachment — never a clone of a real company's branding. Cloning a genuine brand's email teaches employees one narrow thing: distrust that specific fake. It also normalises reproducing another organisation's identity, which is exactly the behaviour security teams exist to stop.

Generic lures exercise the signals that transfer to any phish: an unexpected sender address, artificial urgency, a link that does not go where the text claims, a request that side-steps normal process. An employee who learns to check those tells is protected against next month's novel campaign, not just a familiar template.

Difficulty levels let you tune how obvious those tells are. An easy campaign establishes a baseline; harder ones tighten the craft — cleaner copy, more plausible pretexts — so the programme grows with your team instead of humiliating it on day one.

A single "click rate" hides what actually matters. Infronest records five states per recipient — sent, opened, clicked, submitted and reported — so a campaign result reads as a funnel of behaviour. Opening an email is unremarkable; clicking is a miss; typing into the capture page is the serious signal; and reporting is the behaviour you are actually trying to grow.

That last number deserves the attention. A security-mature organisation is not one where nobody ever clicks — that is unachievable — but one where suspicious email gets reported quickly enough for IT to warn everyone else. Tracking reports per recipient, campaign over campaign, tells you whether that reflex is developing.

The capture page itself is engineered to be safe to run: only the field names an employee filled are recorded, never the values. You learn that someone would have typed a password without ever holding one.

A simulation that ends with a spreadsheet of clickers has produced embarrassment, not security. The module closes the loop two ways: a teachable-moment landing page can explain the miss the instant it happens, and security awareness training modules are assigned per employee afterwards — targeted at the people who clicked or submitted, not broadcast to everyone as an annual chore.

Because campaigns are cheap to repeat with a fresh sender profile and a different lure, the programme becomes a rhythm rather than an event: run a campaign, train the misses, run the next at a higher difficulty, and watch the submitted count fall while the reported count rises.