Simulate
Safe, authorised phishing simulations — and the training that has to follow them.
A simulation that produces a click rate and nothing else is a test with no lesson. Cyber Guys measures what people did, teaches the specific technique that caught them, and shows whether it worked next quarter.
- 14 scenario types across email, QR and MFA fatigue
- 10 pre-approved templates, safety-scanned before send
- Follow-up training assigned automatically to the people who need it
- Recurring campaigns that demonstrate improvement over time
Simulations are authorised by the organisation, run only against its own people, and reported only to authorised administrators.
Invoice fraud scenario · 62 recipients
- Reported without clicking38
- No action taken17
- Clicked the link6
- Submitted details1
- Training auto-assigned7 people
- Click rate vs last quarter11% → 4%
Individual results are visible only to administrators with the permission to see them.
- Simulation scenario types
- 14
- Pre-approved templates
- 10
- Response signals measured
- 8
- Templates that may request credentials
- 0
How it works
Authorise it. Choose it. Measure it. Teach immediately.
- 1
Authorise the programme
An authorised administrator of the organisation sets up the programme and confirms the people in scope. Simulations only ever run against an organisation’s own employees, on its own instruction.
- 2
Choose an approved scenario
Pick from the approved template library or write one. Every template is scanned before it can be sent, and anything requesting sensitive details or using a prohibited theme is blocked outright.
- 3
Send, and measure what people do
The platform records who reported it, who ignored it, who clicked, who scanned a QR code and who submitted a form — and distinguishes real people from security scanners.
- 4
Teach immediately, then repeat
Anyone who engaged gets the module for that specific technique straight away. Recurring campaigns then show whether the behaviour actually changed.
Campaign types
The scenarios your staff are actually sent.
Each maps to a real technique and to the training module that teaches it.
Difficulty is graded, and the risk model discounts a failure on a genuinely hard scenario while adding weight to a failure on an easy one — because being caught by an obvious lure and being caught by a well-researched one are different findings.
Safety
Useful for testing your own staff. Useless for anything else.
That is the design premise of the whole subsystem, and it is enforced server-side on the launch path rather than in the wizard interface.
Safety scanning before send
Every template is checked on the launch path, server-side. Requests for card details, a CVV, BSB and account numbers, a tax file number, an identity document number or a crypto key are blocked, not warned about.
Prohibited scenarios
No dismissal or redundancy, no death or bereavement, no serious medical events, no police or courts, no ATO, Centrelink or Home Affairs, and no promised bonus or pay rise. These cause real harm and produce no learning.
Employee groups
Target a department, a role, a location or everyone. Import employees by file, or synchronise from Microsoft Entra ID or Google Workspace on MSP Pro.
Automatic follow-up training
Each scenario type maps to the module that teaches the behaviour it tested. Someone who falls for invoice fraud gets business email compromise training, not a generic refresher.
Recurring programmes
Monthly or quarterly campaigns that vary the scenario and difficulty automatically, so people are not simply learning the shape of your last test.
Reporting button behaviour
Reporting a suspicious email always reduces a person’s risk contribution and can never increase it. Encouraging reporting is the entire point of the exercise.
Approval workflow
Campaigns can require approval before launch, which is how an MSP runs simulations for a client without ever acting unilaterally on that client’s staff.
Scheduling and pacing
Send windows, drip pacing and business-hours delivery, so a simulation does not arrive at 3am or land on everyone at the same minute.
What a simulation can never collect
- · Real passwords — no simulated sign-in page stores what is typed
- · Credit or debit card numbers, or a card security code
- · BSB and bank account numbers
- · Tax file numbers, Medicare, passport or licence numbers
- · Cryptocurrency seed phrases, recovery phrases or private keys
Sending is controlled by the platform
The sending provider is chosen by environment configuration, never by a tenant — a tenant selecting its own sending infrastructure is exactly how a simulation platform becomes a general-purpose mailer. If a provider is misconfigured, the system falls back to not sending rather than to the platform’s transactional mailer.
Allowed template hosts, per-tenant send limits and recipient-domain checks are enforced at launch, so a campaign cannot be pointed at addresses outside the organisation.
What administrators can measure
Eight signals, and what each one means.
Every signal is behavioural. Nothing in the model reads age, gender, tenure, seniority, department status or any performance data — the factor list is a closed set, and that closure is enforced by a test.
- Reported without clickingThe behaviour you are trying to build
- Opened but took no actionNeutral — no risk contribution
- Clicked the linkTriggers targeted follow-up training
- Scanned a QR codeMobile habits, where the address bar is hidden
- Opened an attachmentAttachment-handling behaviour
- Submitted the formThe highest-weighted signal in the model
- Reported after clickingStill counts positively — recovery matters
- Repeat pattern across campaignsWhere training has not landed yet
Scores decay, so people can actually improve
A click eighteen months ago says very little about somebody today. Contributions fade on a half-life, and anything older than the decay window is ignored entirely. Someone who improves sees their score come down rather than carrying a permanent mark.
Employee privacy
Individual results are visible only to administrators whose role permits it. The bands are named constructively — “improvement opportunity”, not “high-risk employee” — because a simulation programme that becomes a disciplinary tool stops producing honest reporting within a month.
Which plans
Where phishing simulation sits.
Simulations with the approved template library, employee groups, tracking and automatic follow-up training.
Simulations across your client base, plus recurring monthly and quarterly programmes.
Adds board and insurance evidence reporting, portfolio benchmarking and directory synchronisation.
Business Starter, Community Group, Individual Learner and MSP Starter do not include phishing simulation.
A note on the human-risk view
In developmentPer-person and per-campaign simulation reporting is live today. The wider human-risk index — which combines simulation, training and assessment results to show patterns across teams and departments, weight for the people who can do the most damage, and surface systemic control gaps rather than individuals — is built and tested but is not yet wired to tenant data. We would rather say that here than let the diagram imply otherwise.
Run one against us first.
We will walk through a real campaign, the safety checks that stop a bad template, the results view and the training that fires automatically afterwards.