* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
Phishing simulation for a small business
Simple, quick, and with nothing to install
A small business can run a phishing simulation for its employees by itself, without a security team and without a subscription: from ₪999 per one-time campaign, up to 100 employees, in Hebrew and with a summary report. Setup takes less than 15 minutes*. If you have an IT provider, they will be needed for one simple action, allowlisting the sender, and campaign launch is subject to a security review of up to one business day. See also: phishing test for businesses.
Last updated: 19.10.2026 | Written and reviewed by the PhishingU team
Startups, accounting and law firms and small companies are a favorite target for attackers - usually with no security team. Run a phishing test for your employees yourself in 15 minutes, for a one-time payment from ₪999, and receive a report and an awareness training certificate.
* Setup in under 15 minutes, with no technical knowledge - one simple action is required from IT (allowlisting the sender). Launch is subject to a review and approval by the information security team, up to one business day.
What it costs by business size
| Size | Price | Note |
|---|---|---|
| 5-20 employees | ₪999 per campaign | A one-time payment, no subscription |
| 21-50 employees | ₪999 per campaign | The same price |
| 51-100 employees | ₪999 per campaign | Above 100 employees: a managed service by quote |
For the full price list (including awareness training): How much does a phishing simulation cost.
What to do if you have no IT provider
For the exercise emails to reach inboxes, one allowlisting setting is required in the business's email service (for example Google Workspace or Microsoft 365). You receive structured instructions, and if you have no IT person, whoever manages email in the business can carry it out by following the instructions. Launch is subject to a security review of up to one business day.
What to do after the exercise
- Go over the report: who opened, who clicked and who reported.
- Explain to the team, briefly, what could have been noticed in the decoy email.
- Set a simple procedure for reporting suspicious emails and for verifying payment requests.
- Plan a repeat exercise after a few months and check whether the results improved.
For more by type of business, see the pages by industry below, and phishing test for businesses.
Fit for your business
The same simple phishing test, tailored to the risk and the regulation of each type of business.
Even in the smallest campaign, every employee who clicks gets a short training video and a quiz, with no extra work from you: details.
A startup at the beginning of its journey
Customers and investors ask about information security as early as due diligence. A phishing exercise + a certificate give quick, inexpensive proof that you manage cyber risk.
An accounting firm
Access to customers' sensitive financial data makes accounting firms a favorite target for impersonation and BEC. A phishing test checks the employees before the attacker does.
A law firm
Confidential information and attorney-client privilege demand a high level of awareness. A phishing simulation and training produce evidence of meeting security and privacy requirements.
A small company
No security team? The employees are the first line of defense. A phishing exercise from ₪999 fits the budget of a small business, with no subscription and nothing to install.
A clinic and a medical practice
Sensitive medical information is subject to Amendment 13 to the Privacy Protection Law, and awareness training is part of the preparation. A certificate of participation is evidence of training that supports part of the requirements of Amendment 13, and it is not a confirmation of full compliance with the law.
An agency and a services business
Insurance, real estate, marketing and digital agencies hold customers' personal information. A quick phishing check shows where the exposure is and how to reduce it.
Why specifically small businesses?
- Most cyberattacks begin with a phishing email to an employee
- Small businesses usually have no dedicated security team
- A single employee who falls for it can expose the whole business
- Customers and investors often ask for proof of awareness
- Awareness training is part of the preparation for Amendment 13
Frequently asked questions
Did you receive an information security questionnaire from a customer? What to answer about employee training and a phishing exercise.