Protect People
Phishing / Smishing / Vishing
Realistic email, SMS, and voice attack simulations that measure who clicks, who discloses, and who reports.
- Scenarios that mirror real attacks
- Email, SMS, and voice
- Reporting measured, not just clicks
- Cohort-level insight
- No real malware, no harm
You can buy every technical control on the market and still be one convincing email away from an incident. A phishing assessment gives you the number your board actually wants: when a realistic attack lands in your people's inboxes, phones, and headsets, what happens next?
Our phishing assessments simulate realistic email attacks using scenarios designed around your sector, brand, and current threat landscape: IT helpdesk requests, HR notifications, supplier invoices, delivery notices, credential resets. Campaigns track link clicks, credential submissions and attachment executions, and just as importantly, reporting actions, because staff who raise the alarm are your best early-warning system. Realistic landing pages can be included; real malware never is.
Get a quote for Phishing / Smishing / Vishing
Tell us your scope and objectives, and we’ll come back with a clear, fixed proposal, usually the same working day.
Get a Quoteor call +44 (0) 203 393 7795- CREST-accredited
- UK-based specialists
- Crown Commercial Service supplier
How it works
- 01
Scoping and design
A questionnaire and scoping call establish your objectives, then we design realistic scenarios tailored to your sector, brand, and threat landscape. Rules of engagement are agreed and the Statement of Work is signed before any activity begins. Typically one to two weeks.
- 02
Assessment execution
Campaigns, calls, or on-site attempts run within the agreed window, with every interaction documented in real time so nothing rests on anecdote.
- 03
Reporting and debrief
We analyse the results and deliver a report and executive summary through Sentry, followed by a debrief session. For recurring programmes, each round is benchmarked against your baseline so you can evidence improvement.
Beyond the phishing assessment: smishing and vishing
Email is only one channel. Smishing assessments send SMS messages to agreed recipients and track click and response rates. Vishing assessments go further: our consultants call your staff impersonating plausible third parties (IT support, HMRC, a supplier, a bank fraud team) and test what gets disclosed, whether unsafe instructions are followed, and whether the call gets escalated. These are the channels most awareness programmes underrepresent, and attackers know it.
Results are broken down by cohort (department and location) so you can see exactly where susceptibility concentrates, and delivered through Sentry as a full report with susceptibility rates, per-scenario breakdowns, an executive summary, and recommended actions, followed by a debrief. Channels can be run separately or combined into a single engagement, and the debrief focuses on practical next steps: which cohorts need attention, which processes failed, and what to change first.
Everything is agreed in writing before any activity begins: scenarios, recipients, rules of engagement, signed Statement of Work. Many clients repeat the exercise quarterly or bi-annually to benchmark improvement, and when you are ready for continuous, automated simulation and training, our Human Risk Management platform takes over from there.
What you get
Scenarios that mirror real attacks
Pretexts tailored to your sector and brand (supplier invoices, IT resets, delivery notices), not generic templates.
Email, SMS, and voice
Phishing, smishing, and vishing tested separately or combined, covering the channels attackers actually use.
Reporting measured, not just clicks
We track who raised the alarm as well as who fell for it: your reporting rate is a defence worth measuring.
Cohort-level insight
Results by department and location show where awareness effort will pay off most.
No real malware, no harm
Realistic landing pages and pretexts with nothing dangerous behind them, under signed authorisation.
Benchmarkable programmes
Quarterly or bi-annual repeats measure improvement against your baseline.
Frequently asked questions
Straight answers to what prospective clients ask us most.
Will employees be individually identified?
Results are reported at cohort level (by department or location) to drive improvement rather than blame. What we measure includes positive actions like reporting, so the exercise recognises good behaviour as well as gaps.
Is real malware ever used?
No. Campaigns use tracked links, safe attachments, and optional realistic landing pages: nothing that could harm a device or your network. The realism comes from the scenario design, not from dangerous payloads.
Can we test email, SMS, and voice together?
Yes. The three channels can run as separate engagements or one combined assessment: combining them shows whether staff who are sharp on email stay sharp when the same pretext arrives by text or phone call.
How is this different from an awareness training platform?
This is a point-in-time, consultant-designed measurement of how your people respond to realistic attacks. Ongoing automated simulation and training is a different job: that is what our Human Risk Management service provides, and the two work best together.
How often should we run a phishing assessment?
An initial assessment sets your baseline; quarterly or bi-annual repeats show whether awareness investment is working. We benchmark each round against the last so the trend is visible, not anecdotal.
Related services
Ready to talk about phishing / smishing / vishing?
Get a fixed-scope quote, usually the same working day.