Prepare every employee with phishing simulations & training

Stop dreading the day a phishing attack slips past your cyber defenses. Get the peace of mind from knowing your employees are prepared if it happens.

Choose from 1,000+ realistic phishing templates

Build simulated phishing campaigns from our library of over 1,000 templates to teach employees how to avoid the most dangerous phishing threats they face.

New templates are added weekly to simulate ongoing attacks, leverage recent news and keep employees ahead of new threats. Build your own phishing simulation campaign or select template categories to run automatically.

Simulate the most sophisticated phishing attacks

Prepare your employees for the most challenging threats they face by simulating the same domain spoofing techniques, typosquatting and attack types scammers find most effective.

Every template is paired with phishing microlearning tailored to the specific email. If an employee fails a phishing simulation, they immediately receive a short training lesson that highlights the red flags they missed and reminds them how to identify and report similar emails in the future.

Frequently asked questions

  • How do phishing simulations teach employees to avoid phishing emails?
    • Even the best email gateways and security tools fail to catch 100% of the phishing emails targeting your employees and organization. This makes teaching your employees how to prevent phishing attacks vital.

      Simulations go beyond phishing awareness training. A simulated phishing campaign allows you to not only test employees in the same environment where real phishing emails strike — their inbox — but it also lets you deliver training the moment the employee clicks a suspicious link to educate them in the teachable moment.

  • What happens when an employee clicks a simulated phishing email?
    • If an employee fails to recognize a simulated phishing email, clicks a link, opens an attachment or enters information on a spoofed domain, Infosec IQ automatically delivers training tailored to the event. This training is delivered immediately — in the teachable moment — to help the employee recognize suspicious emails and learn how to stop phishing attacks from impacting your organization.

  • Can I run an Infosec IQ phishing test for free?
    • Yes! Run a free Phishing Risk Test and send a simulated campaign to 100 employees. We’ll send you the results within 24 hours so you can learn your organization’s phish rate and see who took the bait.

  • What are some of the most common phishing email examples?
    • Although new phishing scams appear nearly every week, we consistently see phishing attacks built around the following topics.

      Shipment notifications
      These emails typically spoof an online retailer such as Amazon or Walmart or a delivery company such as UPS. The phishing email informs the victim of a package arrival, baiting them to click a link or provide personal information to investigate the unknown delivery.

      Tax-related phishing scams occur throughout the year, but appear more frequently at the end of January when U.S. organizations provide employee W-2 forms and through April when taxes are due.

      Banks and payments
      Bank alerts and notifications from merchants and payment processors such as PayPal provide scammers an avenue to victims’ financial information. These scams frequently reference a fraudulent charge to trick victims into clicking a malicious link or providing personal information.

      Internal and corporate communications
      Business email compromise (BEC) attacks, spoofed messages from Human Resources and other corporate communication scams remain a common tactic for hackers to acquire credentials, employee records or even financial information.

  • Can I create my own simulated phishing templates?
    • Infosec IQ allows you to create your own phishing templates, copy real phishing scams your team encounters or customize any of the 1,000+ existing phishing using our drag-and-drop template editor. You can also customize or build your own phishing indicator training, spoofed domains, landing pages, education pages and more.

  • Do Infosec IQ phishing templates use real brand logos?
    • Yes. Many Infosec IQ simulated phishing templates contain fair use, brand logos to replicate authentic, in-the-wild phishing attacks. Phished learners are immediately redirected to an Infosec IQ education page to remove brand confusion and turn the interaction into an educational moment.

      From a copyright point of view, including third party logos in simulated phishing emails constitutes fair use because the logos serve a new and transformative purpose. Using third party logos for security awareness and training purposes is not related to the sale of goods or services; therefore it does not undermine the copyright holder.

  • Does Infosec IQ include international phishing templates?
    • Infosec IQ includes over 300 international phishing templates, translated and localized for multinational teams.

  • What types of phishing attacks can I send from Infosec IQ?
    • Infosec IQ’s phishing simulator supports the following phishing attack types:

      • Drive-by
      • Data entry
      • Business email compromise (BEC)
      • Spearphishing
      • Malware & malicious attachments
      • USB

      In addition to these attack types, Infosec IQ allows you to send from Phishy Domains, redirected clicks to spoofed landing pages and track email replies to see if employees share sensitive information.

  • How can employees report both suspicious and also simulated phishing emails?
    • Install the PhishNotify reporting plugin to allow employees to report suspicious emails to your team. Once installed, the PhishNotify reporting button appears in your employees’ inboxes, allowing them to report emails with a single click. Reported emails are sent to quarantine for your team to investigate and added to PhishHunter for automated analysis and sorting.

  • How can I encourage employees to report suspicious emails?
    • To start, make sure employees know how to report suspicious emails and what happens when they report both real phishing attacks and also simulated phishing emails. Solutions like Infosec IQ provide immediate feedback each time an employee reports an email by specifying whether the email was a simulated phish or potentially malicious.

      Phishing training for employees helps highlight the importance of reporting emails, but you can also encourage employees to report suspicious emails by congratulating top reporters or providing incentives to encourage participation.

Customize phishing templates or build your own

Every aspect of the Infosec IQ phishing simulator and training is customizable, giving you the ability to tailor employee phishing training to your organization’s greatest threat. Copy and paste real emails to send as simulated phish, use the drag-and-drop phishing template editor to quickly update existing templates or build your own from scratch.

With Infosec IQ, you can use custom phishing domains, create your own spoofed landing pages, build your own phished learner education pages and more!

Empower employees to report phishing emails

Turn your employees into active members of your cybersecurity defense with the PhishNotify email reporting plugin. Install the reporting button globally and encourage employees to report phishing emails with a single click.

Infosec IQ automatically thanks employees when they report phishing simulations and moves real email threats to quarantine for your team to review or to PhishHunter for automated threat analysis.