Phishing Simulations

We Test Your People, Not Just Your Systems

Most breaches start with a phishing email. We run realistic simulations that mirror the tactics used by real threat actors – spear phishing, pretexting, credential harvesting, and payload delivery. Then we work with your team to turn the results into measurable improvements in security awareness.

We don’t just send a generic phishing email and hand you a pass/fail report. We craft targeted campaigns based on real-world reconnaissance of your organisation, test different attack vectors, and provide actionable training that helps your team recognise and report threats.

Attack Vectors We Simulate

Real attackers don’t limit themselves to email. We simulate the full range of social engineering techniques your organisation faces:

• Spear Phishing (Email): Targeted emails crafted using OSINT gathered from LinkedIn, company websites, job postings, and social media. We create convincing pretexts – IT support requests, HR policy updates, invoice approvals, CEO directives – tailored to specific departments and roles.

• Credential Harvesting: We build pixel-perfect replicas of your login portals (Microsoft 365, Google Workspace, VPN, internal apps) hosted on lookalike domains. We track who clicks, who enters credentials, and who enters MFA codes – giving you a precise measure of credential theft risk.

• Payload Delivery: For red-team-style engagements, we deliver simulated malicious payloads – macro-enabled documents, HTML smuggling attachments, or ISO/LNK files – to test whether your email gateway, endpoint protection, and users collectively stop the attack chain.

• Vishing (Voice Phishing): Phone-based social engineering calls targeting helpdesk staff, IT support, or finance teams. We test whether employees follow identity verification procedures when asked to reset passwords, transfer funds, or share access credentials.

• Smishing & QR Code Phishing: SMS-based attacks and malicious QR codes placed in physical or digital contexts. These vectors bypass email security controls entirely and test your employees’ awareness on their personal devices.

• MFA Fatigue & Push Attacks: For organisations using push-based MFA, we test whether employees approve unexpected authentication prompts – the same technique used in high-profile breaches at major technology companies.

Our Campaign Methodology

• Reconnaissance & OSINT: We gather intelligence about your organisation the same way a real attacker would – employee names and roles from LinkedIn, email format conventions, technology stack from job postings, recent company announcements for timely pretexts, and supplier relationships for supply-chain phishing scenarios.

• Infrastructure Setup: We register lookalike domains, configure SPF/DKIM/DMARC to maximise deliverability, build credential harvesting pages, and set up tracking for opens, clicks, credential submissions, and MFA token captures. All infrastructure is dedicated per engagement and decommissioned afterwards.

• Campaign Execution: We run phishing waves at different times and days to test response across shifts and time zones. Campaigns can be staggered to test different pretexts, difficulty levels, or departments – giving you comparative data on which teams are most at risk.

• Real-Time Monitoring: Throughout the campaign, we monitor results in real time. If we identify a critical gap – such as credentials being entered that grant access to sensitive systems – we can alert you immediately rather than waiting for the final report.

• Metrics & Reporting: We track open rates, click rates, credential submission rates, MFA bypass rates, and report rates (did employees report the phishing attempt to IT?). Results are broken down by department, seniority, and campaign type – giving your leadership team data they can act on.

What We Test Beyond the Click

A phishing simulation isn’t just about who clicks. We also assess:

• Email Security Controls: Does your email gateway (Mimecast, Proofpoint, Microsoft Defender for O365) catch our simulated phishing emails? We test SPF/DKIM/DMARC enforcement, URL rewriting, attachment sandboxing, and impersonation detection.

• Incident Response: When employees report a phishing email, how quickly does your SOC or IT team respond? Do they quarantine the message across all inboxes? Do they block the sending domain? We measure the full detection-to-response pipeline.

• MFA Effectiveness: If credentials are captured, does your MFA implementation actually prevent account compromise? We test for session token theft, MFA fatigue, and legacy authentication protocols that bypass MFA entirely.

Example Campaign Results

Representative outcomes from recent phishing engagements (anonymised):

• CEO Fraud via Supplier Impersonation: We impersonated a known supplier using a lookalike domain and sent a fake invoice update to the finance team. 3 out of 5 finance staff clicked the link, and 2 entered their Microsoft 365 credentials on our harvesting page – credentials that had Global Admin privileges in Azure AD.

• IT Helpdesk Vishing: We called the helpdesk posing as a new employee who had been locked out of their account. Without verifying identity through the documented procedure, the analyst reset the password and read the temporary credentials back over the phone – granting access to the corporate VPN.

• HTML Smuggling Bypasses Email Gateway: A macro-based payload was blocked by the email gateway, but an HTML smuggling attachment bypassed all detection. The embedded payload executed on 4 endpoints before EDR flagged it – demonstrating a gap between email security and endpoint protection.

Why Choose FORTBRIDGE?

• Red Team-Grade Social Engineering: Our phishing simulations are run by the same offensive security consultants who conduct our red team engagements – not a generic awareness platform sending templated emails.

• Custom Campaigns, Not Templates: Every campaign is built from scratch using real OSINT about your organisation. We craft pretexts that your employees would genuinely find convincing.

• Actionable Metrics: We deliver data your leadership can act on – department-level risk scores, trend analysis across repeat engagements, and specific recommendations for technical controls and training focus areas.

Take the First Step Towards Enhanced Security

Protect your business from phishing threats with FORTBRIDGE’s realistic phishing simulations and social engineering assessments.

Book a Discovery Call to discuss your requirements and get a scoping estimate.