Cyber Awareness, simulated phishing
Simulated phishing campaigns aimed at your staff, prepared and launched by us, with the results person by person.
Targeted training, because it is measured
Security training works when it is targeted, and to target it you need to know who really needs help. Simulated phishing campaigns send convincing emails to your staff and measure what happens: who opens them, who clicks, who goes as far as typing their password into a fake page, and who reports the attempt instead.
From there, training is built on data, not impressions. And the next campaign tells you whether it worked.
It is a managed service: we at Dottor Marc prepare and launch the campaigns. You do not have to configure anything; you find the results in the portal.
What you get
Done by us
Realistic simulations prepared and launched by our team, with no tools for you to learn.
Clear numbers
How many emails were opened, how many links clicked, how many credentials entered.
Detail for each person
The result for every recipient, so you understand where training is really needed.
The right behaviour too
Anyone who reports the attempt is recorded: you measure who reacts well, not only who gets it wrong.
A simulated phishing campaign, step by step
We prepare it together
We agree the recipients and the period of the campaign with you. Our team prepares the message and the landing page.
We launch it
The emails are sent from our simulation platform. Your staff receive a convincing message, just like the real ones.
You see the results
In the portal you follow the campaign as it unfolds: the data arrives in real time, with no update delays.
Action is taken
Those who need help follow the training. The next campaign measures the result.
From campaign statistics to each person's timeline
The results are organised on three levels, from the overall picture down to the individual member of staff.
- List of campaigns, with creation, launch and completion dates and the status of each one
- Campaign statistics: emails sent, opened, links clicked, credentials entered, reports
- Result per recipient: who did what
- Event timeline per person: email opened, link clicked, data entered
Measuring is not enough, it has to be done well
A simulation that is too easy teaches nothing; one that is too aggressive only causes resentment. Preparing convincing campaigns, tailored to your company and repeated over time, is specialist work: that is why we do it, and you are left with the useful part, namely deciding what to do with the results.
The simulation measures, the course corrects. Together they become an awareness programme you can demonstrate.
The Training register keeps track of who has completed the courses, with date and score: it is the evidence that standards ask for on staff preparedness.
Simulated phishing: the questions we are asked most often
Do I have to set up the phishing campaigns myself?
No. Dottor Marc prepares and launches the campaigns: it is a managed service, not a tool to learn. In the portal you find the campaigns that have been run and their results.
Are the passwords entered on the fake pages stored?
The platform records the "data entered" event, meaning the fact that the person went as far as typing their credentials into a page that is not genuine. That is the data you need to target the training.
What happens after a campaign?
You look at the results for each person and decide where to act, for example with the courses in the Training module. The next campaign tells you whether behaviour has changed.
Why simulate phishing in a company?
Phishing remains one of the most common ways an attack begins: all it takes is one person opening an attachment or typing their password into a fake page. Simulating it measures how exposed your company is to this risk, with numbers instead of impressions. What phishing is.
Is security training mandatory under NIS2?
Yes. NIS2 requires basic cyber hygiene practices and cybersecurity training for staff, and provides that members of management bodies must also follow training. ISO/IEC 27001 also requires awareness and competence. The campaigns, together with the Training register, document that you are doing it and with what results.
Can you see who clicked the link?
Yes, the results are per recipient, with the event timeline: opening, click, data entered, report. The aim is to direct training to those who need it, not to punish: it is worth making this clear with management and staff before starting the programme.
Which standards it supports
Staff awareness is an explicit measure in NIS2, ISO/IEC 27001 and DORA. Simulated phishing campaigns make it measurable.
Often activated together
Training
E-learning for your staff, with a record of completed courses ready to show.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.