Offensive Security · Human risk
Phishing Simulation
Would your team fall for a well-crafted scam? Find out before an attacker does.
Realistic phishing campaigns against your own team, reporting by department, and training on the spot for whoever clicked. You measure human risk, track progress, and get audit-ready evidence.
Companies that trust UPX
Recurring
Monthly or quarterly campaigns, with new scenarios every round.
By department
Click rate, credential submission, and report rate, per department.
On the spot
Whoever clicks lands on an instant training page, not a telling-off later.
Why simulate
Annual training does not change the click. Repetition does.
Phishing is one of the most common entry vectors in incidents. A yearly talk ticks the compliance box, but does not change behaviour.
Annual training
Ticks the box, does not change the click
- One video a year, forgotten in a week
- No measurement of who would actually fall for it
- High-risk areas (finance, executives) treated like everyone else
- No evidence of progress for an audit
- The problem only shows up in a real incident
UPX simulation
Measure, train, repeat
- Recurring rounds with new scenarios
- Click and report rates measured per department
- Dedicated scenarios for those with the most access
- Reporting with trend and evidence of improvement
- The team learns from the simulated mistake, not the real one
How it works
Four steps, a cycle that repeats.
This is not a one-off test. It is a continuous programme that turns the team from weak point into first line of defence.
01
Scenarios
Emails, SMS, and fake pages inspired by real attacks against your industry: invoice, HR, executive, supplier, MFA. You approve before anything is sent.
- SMS
- Cloned pages
- QR code
- MFA fatigue
02
Delivery
Staggered sending by group, without tipping off the team or flooding your help desk. Domains and senders look legitimate and are allow-listed in your email.
03
Training on the spot
Whoever clicks or submits credentials lands on a short page explaining what happened and how to spot it next time. Education without embarrassment.
04
Reporting
Rates by department and scenario, comparison with the previous round, and recommendations. Evidence for audits and for the committee.
Metrics that matter
You see exactly where the risk is.
Clicks, credentials submitted, attachments opened, and best of all, how many reported it as suspicious.
| Department | Clicked | Submitted credentials | Reported | Vs. previous round |
|---|---|---|---|---|
| Finance | 12% | 4% | 38% | Improved |
| Executives | 9% | 3% | 21% | Flat |
| Sales | 27% | 11% | 14% | Worsened |
| HR | 15% | 5% | 31% | Improved |
Illustrative example, with fictional data.
What is included
A complete programme, with no effort from your team.
UPX designs, runs, and reports. You approve the scenarios and receive the results.
01
Tailored scenarios
Templates aligned to your industry, brand, and real suppliers: what an attacker would actually do.
02
Segmentation
Campaigns by department, role, or site. Executives and finance get their own scenarios.
03
Metrics that matter
Clicks, credentials submitted, attachments opened, and how many reported it as suspicious.
04
Contextual training
An educational page at the moment of the mistake, plus micro-lessons for repeat cases.
05
Report button
Outlook and Gmail integration so the team can report phishing in one click, real or simulated.
06
Executive report
Monthly or quarterly summary with trend, department comparison, and audit evidence.
Who it is for
It fits three situations.
From those who never measured to those who must prove it to an auditor.
Never tested
Initial assessment
You want to know the real risk before an attacker finds it. The first round becomes the baseline.
- Baseline round with no prior notice
- Click rate per department
- Generic and targeted scenarios
- Plan for a recurring programme
Compliance requirement
Continuous evidence
ISO 27001, LGPD, PCI-DSS, or a client asking for awareness evidence. Reports ready to hand over.
- Documented quarterly campaigns
- ISO 27001 / LGPD / PCI reports
- Training record per person
- Trend for the committee
Already had an incident
Intensive programme
You were phished and want to make sure it does not happen again. Focused on the areas that were hit.
- Focused on the areas that were hit
- Scenarios based on the real attack
- Monthly rounds until metrics stabilize
- Report button rolled out
Education, not punishment
Built for the team to learn, not to expose anyone.
The point of the programme is to reduce risk, not to build a wall of shame. You decide how detailed the reports are, and employee data is handled in line with data protection law.
- Scenarios approved by youBefore anything is sent
- Training without embarrassmentAt the moment of the mistake
- Reporting by departmentConfigurable level of detail
- Data handled per data protection lawDefined in the contract
Deliverables
What you receive.
Assessment
Initial round with the baseline click and report rate per department.
Campaigns
Monthly or quarterly, with new scenarios approved by you.
Training
An immediate educational page and micro-lessons for repeat cases.
Reporting
Executive level, with trend and audit evidence.
FAQ
Before we talk
Can the simulated emails land in spam or be blocked?
The campaign senders and domains are allow-listed in your email provider before delivery, so the simulation reaches the inbox.Who approves the scenarios?
You do. No campaign goes out without prior approval of the scenarios.Do the reports work as evidence for ISO 27001, LGPD, and PCI-DSS?
Yes. The reports document campaigns, results, and per-person training as awareness evidence.How often do the campaigns run?
Monthly or quarterly, depending on the goal. In the intensive programme, rounds are monthly until the metrics stabilize.
Phishing Simulation
How many employees would fall for it today?
Start with an assessment round and find out your company's human risk, department by department.