Phishing simulation for employees
You build and run it yourself, in about 15 minutes*
PhishingU's self-serve phishing simulation is an exercise in which the organization itself builds and runs decoy emails to employees, with no subscription and nothing to install. The price is from ₪999 per one-time campaign, up to 100 employees, and includes a summary report and a certificate of participation. Setup takes less than 15 minutes*, followed by a security review of up to one business day before launch.
Last updated: 19.10.2026 | Written and reviewed by the PhishingU team
You choose a scenario, upload the employee list and set a date. We send the simulation, and you receive a summary report and a certificate of participation. No subscription, nothing to install and no commitment.
* Setup in under 15 minutes, with no technical knowledge - one simple action is required from IT (allowlisting the sender). Launch is subject to a review and approval by the information security team, up to one business day.
What is included and what is not
| Included in ₪999 per campaign | Not included |
|---|---|
| Email templates in Hebrew and a landing page for the exercise | In-person or remote training (as an add-on, ₪1,500 or ₪1,000) |
| Sending to 100 employees at most | A managed service and ongoing support (by quote) |
| A summary report: open, click and report | Continuous monitoring throughout the year |
| A certificate of participation in awareness training | A confirmation of compliance with a law or a standard |
The certificate is evidence of awareness training that supports part of the requirements of Amendment 13; this is not a confirmation of full compliance with the law. Full price list: How much does a phishing simulation cost.
Who the self-serve service suits and who it does not
- Suited to: A small or mid-sized business of up to 100 employees, a startup, an office, an organization that wants a quick one-time exercise in Hebrew, or needs evidence for a customer's security questionnaire.
- Less suited to: An organization of more than 100 employees (a managed service suits it better), or an organization building a continuous annual awareness program with ongoing monitoring, which may suit a subscription platform better.
Frequently asked questions
Do employees know in advance that an exercise is taking place?
The decision is up to the organization. Many organizations announce in general terms that periodic exercises take place, without specifying a date, so as not to affect the results.
Does the exercise endanger the organization's systems?
The emails are decoy messages with no malicious code. A click leads to a short explanation page, and the system does not collect passwords.
How often should you run an exercise?
There is no single frequency. Many organizations run an exercise a few times a year and check whether the report rate rises and the click rate falls.
What happens to an employee who clicked?
They see an explanation page that shows what could have been noticed in the email. The exercise is meant to teach, not to punish.
Does the employee learn anything after clicking?
Yes. On the explainer page they see a short training video and take a 5-question quiz with instant feedback. It is part of the campaign; details on the employee learning module page.
Why is allowlisting needed, and what is it?
Allowlisting is a single IT setting that allows the exercise emails to reach inboxes and not be blocked. You receive structured instructions, and launch is subject to a security review of up to one business day.
What is the difference between the self-serve service and the managed service?
In the self-serve service the organization builds and runs it itself from ₪999 per campaign (up to 100 employees). In the managed service PhishingU plans and runs it, with no fixed price and mainly for organizations of more than 100 employees.
* Setup takes less than 15 minutes and requires no technical knowledge on your part, but one simple IT action is required (allowlisting the sender), and launch is subject to a security review of up to one business day.
How it works
Four steps, all from the browser.
Sign up with a code by email
No password and nothing to install. You enter your work email and receive a login code.
Choose a scenario and recipients
From a library of scenarios in Hebrew and English, you upload the employee list and choose a launch date.
One allowlisting action, and the information security team reviews
One simple action by IT (allowlisting the sender), and launch is subject to a review by our information security team, up to one business day.
Get a report and a certificate
A summary report with open, click and report rates, and a certificate of participation / completion of awareness training.
What is included
- One phishing campaign for up to 100 employees
- Scenarios in Hebrew and English
- A delivery check before launch, and allowlisting instructions
- A summary report: open, click and report rates
- A short training video and 5-question quiz for the employee who clicked (part of the campaign)
- A certificate of participation / completion of awareness training
The certificate is evidence of awareness training on cyber threats that supports part of the requirements of Amendment 13. This is not a confirmation of full compliance with the law.
To the full price list →