Phishing remains the first entry route because it does not attack technology, it attacks haste. A properly run simulation is not there to name whoever clicks: it is there to tell you what share of your workforce would click today, how many report it and how long your team takes to react.
What we measure, and what we do not
We measure
Report rate
This is the metric that matters. An employee who clicks and reports within two minutes is worth more than one who does not click and says nothing.
We measure
Response time
How long your team takes from the first report to containing the campaign across the remaining mailboxes.
We do not measure
Culprits
Results are delivered aggregated by department. We never name individuals: that destroys trust and stops anyone reporting anything again.
Campaign types
Generic phishing: a broad campaign with plausible lures, to establish the organisational baseline.
Spear phishing aimed at specific profiles using real public information. It is what an attacker targeting you actually does.
CEO fraud: impersonating senior management to authorise payments or account changes. It is the one that takes the most money.
Smishing and vishing: SMS and voice calls, increasingly used to bypass second factors.
Credential theft with MFA: we check whether your multi-factor authentication survives an adversary-in-the-middle page, because not every factor does.
How we work
1
Prior agreement
Scope, lures, calendar, briefing of HR and workers’ representatives, and personal data handling. A simulation without this step creates an employment problem and a data protection one.
2
Lure design
Credible and contextual. A badly written email measures nothing: it only proves your people spot badly written emails.
3
Execution
Staggered delivery with tracking of opens, clicks, credential submission and reports.
4
Response measurement
Cross-checked with your security team: when they found out, what they did and how long containment took.
5
Immediate training
Anyone who clicks is shown a page explaining the signals they missed, right then. That is the moment most learning happens.
6
Report and repetition
Baseline, comparison against previous campaigns and a training plan for the weakest areas.
What you get
Rates by department: open, click, credential submission and report.
Detection and response time of your security team.
Analysis of technical controls: what your mail gateway filtered and what it let through.
Awareness plan aimed where it is needed, not generic for the whole workforce.
Comparison with previous campaigns, to evidence progress to management or an auditor.
We complement simulations with formal training. We have trained more than 1,000 students in our cybersecurity courses, including a dedicated corporate awareness programme.
Who does the work. The same team that audits, not an account manager. Governance, risk and compliance: CISSP, CISM, ISO 27001 Lead Auditor, ENS and Risk Analysis (CCN), certified DPO, CCSP and CDPP (ISMS Forum) and PMP (PMI). On the technical side: OSCP, CRTO II and eWPTX, ranked in the top 1% of the CCN-CERT Atenea platform. We have run compliance projects for crypto exchanges, universities and public administrations.
Questions we get asked
Is this legal?
Yes, with the right safeguards: a lawful basis for the processing, prior briefing of workers’ representatives, aggregated data and no disciplinary use. We help you document it before starting.
What if the result is bad?
That is the most likely outcome of the first campaign, and it is exactly what it is for. The value is in the second and third: if the report rate rises and response time falls, the programme is working.
How often?
Quarterly or half-yearly. An annual campaign does not change behaviour; it only generates a report.
Can it be combined with a Red Team?
Yes, and it is one of the most realistic initial access routes. In that case the objective is not to measure the workforce but to get in.
Find out how many would click today
Half an hour with an auditor to design the first campaign and close off the legal framework before launching it.
Phone: +34 686 250 244 (Mon-Fri, 9:00 to 18:00 CET) · Email: info@jaymonsecurity.com
We reply within 2 working hours.
