Offensive Security
Phishing and Vishing Simulations
Scenarios are designed with participant safeguards, agreed data handling and a learning-focused debrief.
- Approved participant groups and scenarios
- Email or voice-based simulation
- Minimal, agreed measurement data
- Learning and process recommendations
The proposition
Examine how processes handle requests
Examine how people and processes handle plausible requests without treating participants as the problem. The work focuses on approved participant groups and scenarios and records where evidence or authorization limits the conclusion.
Measure the decision path, not embarrassment
Phishing and voice impersonation exploit context, urgency and weak verification paths. A responsible simulation should test whether expected habits and reporting routes are workable, not surprise people for spectacle.
Cyberus agrees the audience, pretexts, prohibited themes, data collected and support route in advance. Results are reported at the level needed for learning and handled under the customer’s approved privacy and employment processes.
Suspicious request, safe handling
- Convincing request. A plausible email or call asks someone to act quickly or share something sensitive.
- Verification habit. The recipient pauses to check the request through a separate, trusted route.
- Report route. A simple way to flag the request lets the organisation warn others and respond.
- Protected decision. Money, access or data stays where it belongs because the request was challenged.
Why it matters
- Business risk: Convincing emails and calls can steer well-meaning staff into payments or access changes before anyone checks.
- Decision it supports: Leaders can decide where to simplify verification, clarify reporting or adjust training, without blaming individuals.
- What you receive: You receive a scenario plan, process observations and a learning brief at the level of detail agreed in advance.
Learning evidence with participant safeguards
Scenario plan
Documents audiences, pretexts, approvals, exclusions and support contacts.
- Why it matters
- People deserve clear limits and support; a poorly governed exercise harms trust and invites complaints.
- Supports
- Approval, privacy review and a safe participant experience
Measurement model
Defines the minimum events collected and how they will be interpreted.
- Why it matters
- Collecting more than needed adds legal and ethical exposure without improving the lesson.
- Supports
- Reasoned limits on data and how results are read
Process observations
Reviews reporting, verification and escalation behavior around the scenario.
- Why it matters
- Most real losses depend on whether a request is verified and reported, not on one click.
- Supports
- Fixing weak approval and escalation routes
Learning brief
Recommends communication, workflow or training changes without shaming individuals.
- Why it matters
- Shaming discourages reporting, which is the habit the organisation most needs.
- Supports
- Practical changes to guidance, workflow or training
How a responsible simulation runs
Why choose Cyberus
The simulation may identify where instructions or reporting routes need improvement. One exercise cannot establish a permanent level of human resilience.
Phishing and Vishing Simulations
Frequently asked questions
Will individual names appear in the report?
Reporting granularity and access are agreed in advance, with the minimum personal data needed for the learning objective.
Can executives be included?
Only when included in the authorized participant scope and protected by the same scenario and data safeguards.
Is success just a low click rate?
No. Reporting, verification, escalation and the clarity of organizational guidance can be more useful measures.
Team certifications
Individual qualifications held by members of the Cyberus team. They are not company accreditations, and not every consultant on an engagement holds every badge.
OSCP
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
OSWE
Web application security skills, including source code review and exploiting complex web vulnerabilities.
OSED
Exploit development skills, including analysing Windows software and writing custom exploits.
OSCP+
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
CRTA
Red team analysis skills, including adversary tactics and techniques.
eWPT
Web application penetration testing skills, from assessment method to exploiting common web flaws.
eWPTX
Advanced web application penetration testing skills, including complex attack techniques.
eMAPT
Mobile application penetration testing skills for Android and iOS applications.
BTL1
Defensive security skills across security operations, phishing analysis, forensics and incident response.
eCIR
Incident response skills, including investigating, containing and analysing security incidents.
CRTE
Red teaming skills focused on Windows environments and the tradecraft used against them.
CCT
EC-Council's Certified Cybersecurity Technician (CCT) validates foundational security, network, and defense skills.
Security+
CompTIA Security+ validates core skills in baseline cybersecurity, risk management, and threats.
Design a learning-focused simulation
Describe the participant group, decision habits and reporting process you want to review.