How it works
One loop, four moves, each one feeding the next.
Most awareness tools run a campaign and produce a number. This one is a circuit: what your people catch becomes intelligence, the intelligence shapes the next simulation, and the simulation decides who gets which training. Every pass raises the score rather than repeating the measurement.
Move 01 01Report
A Report button in Outlook and Gmail. One click sends the full message to an analyst Threat Inbox, attributed to the organisation that caught it.
The add-in puts a Report button in every mailbox, so the person who spotted the lure does not have to forward it, describe it, or decide whether it is worth mentioning. The full message — headers, body, attachments — reaches an analyst queue intact, which is what makes it usable as evidence rather than as an anecdote.
Move 02 02Analyse
Reports meet the catalogue: known-exploited flags, profiled threat actors, and breach-exposure monitoring of your domains.
A report on its own is one email. Against the catalogue it becomes a data point: is this infrastructure new, who else has seen it, does it match an actor we profile, and are any of your people already exposed in a breach corpus. That is the difference between a spam folder and an intelligence picture.
Move 03 03Simulate
Campaigns modelled on what is actually circulating here this quarter — safe, measured, department by department.
Templates derive from what is landing in inboxes in this market now, not from a global library’s greatest hits. Campaigns run per department and per risk profile, tracking opens, clicks, attachment opens and credential submission, so a result is specific enough to act on.
Move 04and back to 01 04Train
The people who clicked get the course that closes their specific gap. Completion tracked, repeat-clickers surfaced.
Assignment follows the outcome rather than the calendar. Someone who submitted credentials to a payroll lure gets the payroll lesson, not the annual video. Completion and comprehension are tracked to the individual, and anyone who clicks twice is surfaced rather than averaged away.
A checklist ends. The reason this is drawn as a circuit is that move 04 changes move 03: the training someone completes changes what they fall for, so next quarter's simulation has to be different to tell you anything. And move 01 changes move 02 — every report from a client organisation is a data point no global feed has, which is what makes the analysis regional rather than generic.
Run once, it is an audit. Run continuously, it is a control.
Thirty minutes, with lures from your sector and the intelligence view your organisation would see on day one.
The per-seat rate is published and the calculator is on the page. You do not have to talk to anyone first.