* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
Our services
Comprehensive information security solutions for your organization
PhishingU provides phishing checks, phishing simulations and staged phishing campaigns tailored to organizations. Information security services include: security awareness training, employee awareness programs, cyber training, penetration testing, and red team exercises. Professional information security consulting by security experts. The goal: to mirror real attack scenarios, measure human and technical risk, improve detection and response, and prevent phishing effectively.
Our main services
Four ways to work with us, depending on your organization's size and needs
Self-serve
Build and run a phishing simulation yourself. Up to 100 employees, one-time payment, report and certificate included.
How it worksManaged service
We plan, run and analyze a simulation tailored to your organization. Best suited to organizations with more than 100 employees.
Learn moreEmployee awareness training
A 60-minute session for a group of up to 30 employees with a CISO, at your office or remotely (Zoom/Teams/Google Meet). Ordered together with a campaign, the in-person training includes one extra campaign at no charge.
Order trainingWhite label for partners
Phishing simulations and training under your own brand, for the clients of cybersecurity firms, IT providers and consultants.
For partnersAll services
Choose the service that fits your organization's needs
Our methodology
How does it work?
Scenario scoping
Scoping tailored to the customer's environment and business domain, including research and planning of spear and whaling attacks, spoof pages and complementary channels.
Staged rollout
The campaign is carried out in a way that is transparent to management only, with no operational harm and with full control of the process.
End-to-end measurement
Tracking of opens, clicks, submitted details and reports. Immediate feedback to employees who fell for the trap.
Reporting and recommendations
A detailed report with trends, weak points and recommendations. A debrief session with the blue team and a practical improvement plan.
Service levels
Lateral simulation - penetration testing and cyber exercises
Advanced information security services: cyber exercises, penetration testing and in-depth phishing simulations. Assessment of post-phish consequences inside the organization, visibility in the SIEM, incident response, and risk mapping. Information security consulting including cyber training.
- Phishing simulation and lateral movement
- Penetration testing and SIEM visibility testing
- Incident response assessment and cyber training
- Risk mapping across departments
- An in-depth technical report and information security consulting
- Recommendations for improving the response
Baseline - phishing simulation and employee awareness
A phishing exercise and a realistic phishing campaign to raise employee awareness. Information security training with open, click and report metrics. Includes learning pages, immediate training content and periodic phishing checks. Information security awareness services.
- Phishing exercises and a custom phishing campaign
- Tracking of opens and clicks
- Interactive learning pages for information security training
- A detailed report with recommendations
- Full support throughout the process
Red team - a professional red team exercise
Comprehensive red team services: advanced phishing exercises, in-depth penetration testing, targeted phishing simulations, incident response exercises and tabletop exercises. Includes intelligence gathering, advanced impersonation, information security testing, control bypass and identification of paths to critical systems. Information security consulting at the highest level.
- Phishing exercises and in-depth intelligence on the organization
- Penetration testing and advanced impersonation
- Full incident response (IR) exercises
- Tabletop exercise (TTX) for the board and management
- Bypassing protection systems and information security testing
- Identifying paths to critical systems
- A detailed executive-level report and information security consulting
Support toward meeting part of the requirements of standards and regulations
Our services help meet the requirements of:
Readiness and response exercises
Beyond phishing simulations, we run incident response exercises and tabletop exercises for management teams
Incident response exercises
A full simulation of a cyber incident to test the response of the technical and operational teams. Includes detection, containment, eradication and recovery.
- A real attack simulation
- Testing the SIEM and monitoring tools
- Coordination between teams
- Identifying gaps and weak points
Table Top Exercise (TTX)
A structured exercise for the board and senior management to discuss and respond to a cyber incident. It focuses on business and strategic decision-making.
- Scenarios tailored to the industry
- Critical business decisions
- Crisis communication and media
- Documentation that supports the exercise of judgment and the duty of care (not legal advice)
A completion certificate and official confirmation of a phishing exercise
PhishingU issues a completion certificate and a detailed official confirmation of a phishing check, phishing exercise and information security simulations. The certificate and confirmation are evidence of awareness training that was carried out, which supports part of the requirements presented by cyber insurers, customers, investors and regulators. This is not a confirmation of full compliance with a law or a standard.
The certificate and confirmation include:
- The date of the phishing check and exercises
- The number of participants and full percentage coverage
- The types of scenarios tested (email, smishing, vishing, whaling)
- Detailed results and success metrics of the phishing checks
- The percentage of improvement compared with previous phishing checks
- Professional recommendations for improving and strengthening security
- An official PhishingU certificate to present to insurers, customers, investors and regulators
An official completion certificate - multiple uses
The official PhishingU certificate and confirmation are evidence of training that was carried out, which some insurance companies, customers and business partners, investors (due diligence) and regulators may ask for. The decision whether to accept it, and whether to grant a policy discount, remains with the requesting party or the insurer. This is not a confirmation of full compliance with a law or a standard.
📋 For cyber insurance companies
Documentation of periodic phishing checks that can support a conversation with the insurer, with no promise of a discount
🤝 For customers and partners
Showing a commitment to information security - trust and transparency
💼 For investors
Due diligence - documentation that supports risk management
⚖️ For regulators
Evidence of awareness training that supports part of the requirements of ISO 27001, SOC 2, HIPAA, PCI-DSS and Amendment 13 to the Privacy Protection Law (this is not a confirmation of full compliance with a law or a standard)