The classic: a pretext, a link, and a landing page that looks like your sign-in. Delivered over your own mail configuration, tracked from open to click to submission.
A text is harder to scrutinise than an email—no sender domain, no hover-to-see-the-link, read on a phone in three seconds. Delivered and status-tracked through Telnyx.
An automated call with a pretext, asking for a code. This is how help-desk fraud and MFA-fatigue attacks actually land, and almost nobody tests for it.
Click the link, enter something, answer the call—whatever happens, the last thing the person sees or hears is the debrief: this was a drill, here is what gave it away, here is what to do next time. No shaming, no gotcha league table. A simulation that only produces a failure rate teaches nobody anything.
And we never capture what they typed. The fake sign-in form records that someone would have submitted credentials—the password itself is discarded, unread. The same holds on a call: we record that digits were entered, never the digits.
Nothing was compromised and nothing you typed was stored. Here's what should have given it away:
A library of 7 built-in scenarios graded easy to hard, plus your own.
Password expiry, a shared document, an unusual sign-in, a supplier changing bank details, an app asking to connect to your account. Each carries the red flags it's teaching, so the debrief writes itself.
Write your own pretext for any channel, with merge fields for the recipient's name and your organisation's wording. A simulation that mentions your actual payroll provider lands differently.
Target the whole directory, a group, a department, or the people who fell for the last one. Roster comes live from Workspace or Entra—no CSV to maintain.
Schedule a campaign for a date, and sends are paced rather than blasted in one instant, so a large audience doesn't tip each other off at the coffee machine.
Opened, clicked, submitted, and—the one that matters—reported. A team that reports faster is the actual goal; click rate alone is a vanity metric.
Anyone who submits can be enrolled into the matching training module automatically, with reminders chased until it's done. The test becomes the trigger, not the report.
A voice campaign can speak in a cloned voice rather than a synthetic one, because "the CFO called and it sounded exactly like him" is the scenario boards are actually asking about. It is deliberately gated: you record or upload a sample, name whose voice it is, and confirm in writing that you're authorised to clone it. The profile won't save without that confirmation, and who consented and when is stored alongside it.
Clone only voices you have permission to use. Voice and text simulations stay in preview—nothing is delivered—until your organisation configures a telephony provider, so the capability can't be switched on by accident.