People.

We phish your own staff the way someone hostile would, including attempts that capture a live session rather than showing a lookalike login page. The result is not whether people can spot a fake page — it is whether someone could walk in with a stolen login today, and which accounts that applies to.

• attempts that get past multi-factor login, not just a lookalike page
• real session capture, so a result is a working login
• who is vulnerable, rather than one company-wide score

Whoever falls for a phishing test gets the lesson that addresses that specific mistake, at the point the mistake happened rather than at the next annual session. Because the tests keep running, you can see whether behaviour changes afterwards instead of recording attendance.

• the lesson follows the failed test
• assigned to the person who needs it
• behaviour you can watch change, not attendance

Phish Guard reads incoming mail in context, scores the real risk and acts on the dangerous messages. The point of scoring in context is that the mail everyone needs to do their job still arrives, so the protection does not become a queue somebody has to release from every morning.

• incoming mail read in context, not by a keyword
• the dangerous ones acted on automatically
• the mail people need to work still arrives

The three above, run as one continuous programme rather than an annual exercise: we find who is vulnerable, train them, and show whether the risk is going down. It is one of the six ways to work with us, and it runs continuously.

• real phishing tests
• training that follows
• risk you can measure