What is a phishing exercise?

A phishing exercise is a controlled simulation in which decoy emails are sent to employees to see who clicks links, who submits details and who recognizes and reports the phishing attempt. The goal is measurement, not punishment.

Is the exercise harmful to systems?

No. The decoy emails contain no malicious files and do not harm infrastructure. The links lead to a measurement page only, which records the action and shows an explanation to the employee who clicked.

How long does it take to organize a phishing exercise?

After a short scoping meeting, PhishingU can run an exercise within a few days. After the campaign, in-person training is carried out, and a repeat exercise after a pre-agreed period to measure effectiveness.

What do you get at the end of a phishing exercise?

PhishingU provides a detailed report that includes: click rates, rates of credentials submitted, report rates, a breakdown by department or role, and focused recommendations for improvement.

Can a phishing exercise be repeated?

Yes - and it is even recommended. One exercise gives a baseline, but real improvement comes from tracking over time: an exercise, training, and another exercise afterwards.

A controlled simulation - with no harm to infrastructure

A phishing exercise for your organization
Real measurement, not assumptions

PhishingU runs a controlled phishing exercise: it sends decoy emails, measures click rates and provides a detailed report with focused recommendations for improvement.

How is a phishing exercise carried out?

Scoping and planning

Phishing scenarios relevant to the organization are chosen - at a tailored difficulty level and according to the goal of the exercise

Sending decoy emails

PhishingU sends emails to the agreed employee list - from a variety of decoy addresses

Real-time measurement

Tracking of clicks, submitted details and reports - without harming infrastructure

A report and recommendations

You receive a detailed analysis by department, role and risk level - with a recommendation for next steps

What does the report you receive include?

At the end of the phishing exercise, PhishingU provides a detailed report that lets you make data-based decisions.

Overall and per-department click rates

Rates of credentials submitted

Rates of reporting a suspicious email

A breakdown by role and risk level

A comparison to a previous exercise (if relevant)

Recommendations for next steps

After the exercise - focused training

The exercise data lets you tailor information security training to the people and departments who need it most - training that is far more effective than a generic program.

Reinforcement starts at the click: a short training video and a 5-question quiz. See Employee learning module.

Frequently asked questions about a phishing exercise

Ready to run a phishing exercise?

Leave your details and we will get back to you to schedule a short scoping meeting, free of charge.

Phishing simulation for employees Information security training DMARC / SPF / DKIM check

For cyber companies, MSPs and consultantsOffer your customers a phishing simulation and awareness training under your own brand. You give the instruction, we deliver.White label for partners

Run a phishing simulation for your employees yourself - in 15 minutes* · from ₪999

* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.

How it works, pricing and frequently asked questions Order awareness training only

A phishing exercise for your organizationReal measurement, not assumptions