RuleCrest
Add-onsPhishSim
Coming soonTest the training. Make reporting a habit.
PhishSim sends realistic, harmless phishing messages to your people and gives everyone a one-click Report phish button. Training answers "did they learn it?" Simulation answers "do they do it?"
After training, someone asks whether it works
An owner, a customer or a cyber-insurance application will often ask the same follow-up to "do your staff take security awareness training?": are they tested on it, and what happens when someone spots a suspicious message? PhishSim is built to give a straight answer to both, with numbers from your own people.
Send, report, learn, measure
Choose a scenario
Pick lures that fit the sector: an overdue invoice, a delivery notice, a shared document, a benefits update, a portal password about to expire.
Send on a schedule
Messages go out spread across days, so a whole office is never hit at the same minute and nobody can warn the room.
Report with one click
Everyone gets a Report phish button. Reporting is the win, and it also works on real suspicious messages, so the person who looks after security hears about them quickly.
Teach at the moment of a click
A person who clicks lands on a short, kind explanation of the clues they could have spotted, not a scolding.
Show the trend
Administrators see the report rate and the click rate over time. Names are hidden by default.
The report rate matters more than the click rate
A click shows where someone could be fooled. A report shows a person acting as the defense, and it is the number that should rise. The example below uses made-up figures to show the shape of the report.
Reported the message
Ignored it
Clicked the link
Scenarios that fit the place people work
These are the kinds of messages PhishSim is meant to include. They are illustrative and use no real company's name.
The overdue invoice
"Invoice 4471 is past due. Open the attached statement to avoid a late fee." It comes from a name the person half recognizes.
The clue to teach: an unexpected attachment, a deadline, and a sender whose address is slightly wrong.
The urgent wire request
A message that looks like it comes from a senior executive asks a branch employee to send a payment today and keep it quiet.
The clue to teach: pressure plus secrecy. The call-back check exists for exactly this.
The patient portal notice
"Your portal password expires in 24 hours. Sign in here to keep access to patient records."
The clue to teach: the real system never asks you to sign in through a link in an email.
The parent portal update
"A new grade was posted for your student. View the report now." It is sent to office staff who handle many parent messages.
The clue to teach: a request that fits the job perfectly is exactly what makes it convincing.
Phishing is not only email
Two recent events show why the lesson is about the pattern, not the channel. PhishSim tests with email, and what people learn applies to every channel.
-
May 2026 · Education
Voice phishing behind a school platform breach
The group that stole data from the Canvas learning platform is known for voice-phishing campaigns, where an attacker phones an employee and talks them into handing over access. Reporting puts the breach at more than 30 million students and staff.
What it teachesA trusted-sounding caller can do what a fake email does. The rule is the same: verify through a number you already know.
-
Early 2026 · Social media
Instagram accounts taken through an AI chatbot
Attackers posed as locked-out owners and got a support chatbot to send password reset codes to email addresses they controlled. Reporting by the New York Times and 404 Media described tens of thousands of accounts.
What it teachesSocial engineering works on systems as well as people, and a believable story at the right moment is the whole attack.
What PhishSim does, and what it never does
What it does
- Treats a report as a success and thanks the person who made it.
- Keeps individual results hidden from managers unless your organization chooses otherwise.
- Explains the clues after a click, in plain words, in under a minute.
What it never does
- Never collects a real password. The sample sign-in page accepts nothing and stores nothing.
- Never uses a real company's name or branding for a lure.
- Never ranks or shames people in front of colleagues.
Training and testing from one place
Opens from the dashboard
PhishSim appears as a tile for organizations that have bought it. A click launches it with the signed token, so nobody makes another account. It receives the person's name, email, role and organization, and nothing about their training results.
A click points to the right lesson
Someone who clicks is offered the training module that covers what they missed, so the test leads straight to the lesson.
Sources
Checked October 20, 2026.
- IBM, Cost of a Data Breach Report 2025 (initial attack vectors; United States and global averages).
- Verizon, 2025 Data Breach Investigations Report, small and medium business snapshot (ransomware share of breaches).
- TechCrunch, "Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far," September 15, 2026 (Instructure, the voice-phishing group, and the Instagram chatbot attacks, citing the New York Times and 404 Media).
Want to see how your people do?
Sign in to your organization, or look at the other add-ons.