Human risk management

Somebody will click.

Find them before an attacker does.

DarkPhish sends your team the same tricks criminals use — by email, text message, QR code and phone call. Anyone who falls for one is taught on the spot, while the mistake is still fresh. You see exactly where your risk sits, and you watch it come down.

Request a demo See how it works

Your first drill can go out this week · Nothing to install · We set it up with you

  • Email
  • Text
  • QR
  • Voice
drill #47 · payroll fraud · running LIVE
MO

Marta Okafor · Payroll

09:14

m.okafor@nz-payroll-secure.com · sent from outside your company

Two-minute change, your payslip is unaffected.

Hi — Finance moved the payroll cut-off to the 15th. Confirm your account details before then so your payslip is not delayed.

Confirm bank details
ImpersonationUrgency Difficulty 3/5
MO

Marta Okafor · Payroll

m.okafor@nz-payroll-secure.com · sent from outside your company

Payroll cut-off moved to the 15th — confirm bank details

Hi — Finance moved the payroll cut-off to the 15th. Confirm your account details before then so your payslip is not delayed.

Confirm bank details +1 click
1
2
3
  • Almost the right address
  • A deadline that is not real
  • The reply goes somewhere else

Confirm your account

l.moreno@your-org.com
Account number
Submit details

Details handed over

The drill stops right here. Nothing typed is ever kept.

CyberShield Taught on the spot

Payment fraud — how it really works

6 min · starts immediately

0%100%
MO

Marta Okafor · Payroll

m.okafor@nz-payroll-secure.com · sent from outside your company

Report phishing

Payroll cut-off moved to the 15th — confirm bank details

48 people spotted this one and said something

When somebody reports a message, it goes straight to your security team, ready to look at.

SIMULATED — training drill

01 / 05 · Delivered

Human risk score

/100
72 41
High Medium
NIS2ISO 27001SOC 2DORAGDPRYour data stays in EuropeEvidence auditors accept

The problem

It only takes one.

You can buy every product on the market and still lose everything to one person having a busy Tuesday. Attackers know this. It is why almost every serious incident now begins with a message, not a machine.

Nobody breaks in any more. They log in.

Your defences are built to stop software. The attack arrives as a message from a colleague, a courier, a bank — and simply asks. One person answers, and the door is opened politely from the inside.

Training once a year changes nothing.

A course in January is gone by February. Nobody learns from a video they clicked through on a Friday afternoon. People learn from the moment they get it wrong, and only if somebody is there to explain it.

“We did the training” is not an answer.

When the board asks how exposed you are, or a client asks before signing, or an auditor asks for proof, good intentions do not survive the question. You need a number, and something solid behind it.

The email filter is not the whole story.

The message that gets through is a text to a personal phone. A QR code on a poster. A phone call from someone claiming to be IT. Defend one channel and the attack simply walks around it.

None of this is a people problem. It is a practice problem — and practice is something you can actually fix.

See how they get in

How they get in

Ten tricks. One of them works on your people.

Every scam pulls a human lever — fear, urgency, curiosity, the simple wish to be helpful. Which lever works depends entirely on your team. We test all of them, then tell you which one your people fall for.

Pick a trick

01 / 10

Fear

Threatens something bad to force an immediate reaction.

"Suspicious activity on your account — verify before 6 PM"

Typical programme · share of clicks 24%

You stop guessing which risk is real. You train against the weakness that is actually there.

The drills

Every way in. Covered.

Attacks do not arrive by email alone, so neither do we. Start with email, and switch on the other channels whenever you are ready for them.

no-reply@yourbank-secure.com difficulty 4/5

“Re: invoice #4471 — payment delayed”

Familiarity looks exactly like the real one
opened 214 clicked 31 reported 57

The one they all still use.

Messages your people cannot tell from the real thing — the supplier invoice, the payroll change, the password that expires today. The moment somebody hands over a password, the drill stops and the lesson starts, right there on the page.

  • Scenarios written by people who investigate real fraud for a living
  • Each person gets a difficulty that fits them, not one blanket test
  • The mistake becomes the lesson in the same second it happens

It arrives like the real thing.

No spam folder, no setup on your side, nothing for your IT team to configure or approve. The drill lands exactly where a genuine attack would land, which is the only place the lesson counts.

It runs itself.

Decide how often your people should be tested, then leave it alone. Whoever spots the trick gets a harder one next time. Whoever falls for it gets help, not a harder trick.

It fits how you already work.

Your list of people stays current on its own, new starters are covered from their first day, and the training assigns itself. Nobody has to chase anybody, and nothing gets installed on a single laptop.

How it works

Four steps. Then repeat.

Not an event once a year. A habit that quietly takes your risk down every month.

01

Email · Text · QR · Voice

Test.

We send your team a scam worth falling for. Nobody knows it is coming, which is the entire point, and each person gets one pitched at their own level.

02

Per person · per team · per trick

See.

Who opened it, who fell for it, and who spotted it and said something. Broken down by person, by team and by trick, so you know exactly where you stand instead of guessing.

03

On the spot · minutes, not hours

Teach.

Whoever falls for it is taught in that moment, when it actually lands. Short, specific, and about the mistake they just made. Spotting it and reporting it earns credit — that is the habit worth building.

04

NIS2 · ISO 27001 · SOC 2 · DORA · GDPR

Prove.

A report you can hand to your board, your biggest client or your auditor without rewriting it first. Your risk as a single number, with the whole history sitting behind it.

CyberShield

Nobody learns from being caught. They learn from what happens next.

CyberShield is the training side of DarkPhish. It is where a mistake turns into a skill, and where your people can get good at this before anybody ever tests them.

Two moments that matter

Before

Learn it before it ever happens.

Nobody should have to fail first. Your team can work through short courses whenever it suits them, and new starters begin on their first day. People who never fall for a single drill still get better at this, and their score shows it.

  • Open to everyone, from day one
  • Short courses people finish in a coffee break
  • Getting better counts, not just avoiding mistakes
After

Learn it the second it happens.

The moment somebody falls for a drill, the right lesson is already waiting. Not a reminder next quarter. The exact trick that just caught them, explained while they can still feel it.

  • Assigned on its own, matched to the trick that worked
  • Opens at the moment of the mistake, on the same page
  • Finishing it brings their score back down
CyberShield My courses
Your progress 3 of 4 done

Payment fraud and fake invoices

After a drill
6 min Done

Spotting a look-alike sender

Any time
4 min Done

Calls that ask you for a code

After a drill
5 min In progress

QR codes in the real world

Any time
3 min Start

Why people actually finish it

Minutes, not afternoons.

Short enough that nobody has to set time aside for it. That is the whole reason they get done.

About the mistake they made.

Not a general lecture on security. The specific trick, why it worked on them, and what to look for next time.

Progress that counts for something.

Finishing a course moves the number. People can watch themselves getting better, and so can you.

Proof you can hand over.

Who trained, on what, and when. It lands in the same report your auditor already asked for.

Training is part of the same programme, not a separate thing to run. One place, one score, one report.

Results

The number goes down.

Month after month, the same people get harder to fool. This is what that looks like. The panel below is sample data — your own reports only ever show your own team.

Your organisation first nine months · sample

Fell for it

4.0%

Spotted and reported

31%

Handed over details

1.2%

Risk score

38

People who clicked, by month

A typical programme, running continuously

−86%

33% → 4%

Risk by team

Where next month goes

How they were tested

A typical mix

Sample figures, shown to illustrate. Your reports only ever show your own results.

One number your board understands.

Every drill, every lesson and every report rolls up into a single score out of 100. What happened recently counts for more than what happened last year, so the number tells you where you stand today — not where you stood on the day you signed. Put it in front of the board, an auditor or a client, and the conversation is over in a minute.

0–100 One score for the whole organisation
Monthly Risk that stays current
10 Human tricks tested
20+ Short lessons built in

Who it is for

What changes, depending on your seat.

The same programme answers a different question for everybody who has to care about it.

The person who answers for security

A single number for human risk, a trend line that goes the right way, and evidence you can put in front of a regulator. No more defending the security budget with anecdotes and hope.

The team that responds to incidents

Your people turn into sensors. When something genuine arrives, they tell you — and you hear about it in minutes rather than finding out the following quarter.

IT and HR

Nothing to install and nobody to chase. New starters are covered from their first day, the training assigns itself, and your share of the work is close to zero.

Anyone running security for other companies

Every client in one place, under your name and your branding. One report each, one conversation, and a service you can sell on the first call.

Scenarios written for your world

Banking and insurance Invoice fraud, fake suppliers, payments approved in a hurry.
Healthcare Patient records, and the scams that arrive mid-shift on a ward.
Retail and e-commerce Fake invoices, store staff, and fraud at the till.
Industry Supplier fraud and the scams aimed at people on shift.
Public sector Impersonated agencies, procurement fraud, NIS2 obligations.
Education Grant fraud, student scams, impersonated academic staff.

Questions

What people ask us first.

Is it fair to trick our own staff?
It is standard practice, and it is on their side. The point is never to catch anybody out — it is to let people make the mistake somewhere it costs nothing. Results are used to teach, never to punish, and we give you the wording to explain that to your team and their representatives before the first message goes out.
Will people feel humiliated?
Not if it is run well, and we help you run it well. Nobody is named on a wall. Whoever falls for it gets a short, decent explanation and gets on with their day. After a round or two, most teams start treating it as a game they want to win.
What happens the moment somebody falls for it?
It stops right there. The page turns into a short explanation of what just happened and what gave it away, and the matching lesson starts immediately. Nothing they typed is ever kept, by us or by anyone else.
We already do training once a year. Why this?
Because a course once a year is a memory test, taken once and forgotten. This is practice. Our training platform, CyberShield, is open to your people whenever they want it, and the right lesson also arrives on its own the moment somebody slips. People remember the message that genuinely fooled them for years. Nobody remembers slide fourteen.
How long until we are up and running?
Days, not months. Send us your list of people, choose a scenario, and the first drill can go out the same week. We walk the first one through with you personally, so nothing lands badly.
Do we have to install anything?
No. Nothing on your laptops, nothing on your phones, nothing for your IT team to build or approve. We do the setup, and you use it from a browser.
Where does our data live?
In Europe, on European infrastructure, with the data-processing paperwork in place. If your rules require everything to sit inside your own walls instead, that can be arranged.
How do we prove any of this to an auditor?
You hand them the report. It lines up what you actually did against the frameworks they care about — NIS2, ISO 27001, SOC 2, DORA and GDPR — and every action is recorded and dated. They tend to stop asking after that.

Get started

Run the first drill.

Tell us where you are worried. Within a day you get a straight answer and a plan — and if it looks like a fit, a live walkthrough with your team.

Talk to us

info@darkphish.es

Where we are

DarkData · Madrid, Spain

We reply in

Under 24 hours, working days