Phishing Simulation

Test your people before attackers do.

Find out how vulnerable your organisation is to social engineering. Tailored campaigns or a managed platform - we measure what e-learning modules cannot show.

Request simulation Analyse a phishing email

500+ campaigns up to -86% click rate GDPR-compliant

E-Mail Threat Scanner

0 Threats0 Safe

Waiting for incoming emails...

0/6 emails analyzed

0% threat rate

of data breaches involve a human factor (Verizon DBIR 2024): 68%
phishing campaigns conducted: 500+
click rate reduction after 12 months (KnowBe4 2025): -86%
click rate in first test (KnowBe4 Benchmark 2025): 33%

The Problem

Why e-learning alone does not protect

Compliance training conveys knowledge - but does not change behaviour. Only employees tested under realistic conditions learn to spot the difference.

3-second decision

Under time pressure, gut instinct decides - not the knowledge from the last e-learning module. Phishing emails strike exactly at that moment.

Click rate ≠ training score

Employees who pass every training course with 100% still click on phishing emails. Only a realistic simulation reveals the true picture.

$4.5M per incident

The average cost of a data breach (IBM). A regular phishing simulation is the most cost-effective prevention measure available.

Real-world example

Anatomy of a phishing email

This realistic mock-up shows the typical warning signs in a phishing email. Watch as the 5 most common red flags are revealed step by step - exactly how we test your employees.

Mail

Suchen

AntwortenWeiterleitenLöschen

Dringende Sicherheitswarnung: Ihr Konto wurde eingeschränkt

Seien Sie vorsichtig mit dieser Nachricht. Sie wurde von einem externen Absender gesendet.

DKB

Deutsche Kredit BankOnline-Banking Sicherheitscenter

im Rahmen unserer routinemäßigen Sicherheitsüberprüfung haben wir ungewöhnliche Aktivitäten in Ihrem Online-Banking-Konto festgestellt. Zum Schutz Ihrer Daten haben wir den Zugang zu Ihrem Konto vorübergehend eingeschränkt.

Mit freundlichen Grüßen
Thomas Weber
Abteilung Kontosicherheit
Deutsche Kredit Bank AG

Diese E-Mail wurde automatisch generiert. Bitte antworten Sie nicht auf diese Nachricht.
Deutsche Kredit Bank AG | Taunusanlage 12 | 60325 Frankfurt am Main

Spot the 5 warning signs

1Spoofed sender address

The display name says "Deutsche Kredit Bank AG", but the actual address is service@dk-bank-sicherheit.com: a foreign domain with no relation to the bank.

2Impersonal greeting

Your real bank knows your name. "Sehr geehrter Kunde" ("Dear customer") signals a mass phishing campaign sent to thousands of recipients.

3Artificial time pressure

"Within 24 hours" plus an account-suspension threat: a classic panic tactic. Legitimate companies never set deadlines this short via email.

4Deceptive link

The button promises the official site, but the real URL is dk-bank-sicherheit.com/verify: a phishing domain. Always check the link target!

5Request for sensitive data

No legitimate company asks you to enter passwords, TANs or credit card details via email. Never log in through email links.

Click or hover the numbered warning signs in the email.

Two models

Tailored or as a managed service

Choose between personal support from our social engineering experts or a self-service managed platform. If you would rather evaluate the software side first, our comparison of the 12 best phishing simulation tools shows what open-source options can do - and where their limits are.

	Recommended Manual Phishing Simulation Personal support from our experts	Managed Managed Phishing Platform Self-service platform via phished.io
Included	Handcrafted, individual phishing emails Spear phishing, CEO fraud and industry-specific scenarios Dedicated point of contact for the entire campaign Detailed report with management summary Ideal for one-off baseline tests and targeted campaigns	AI-driven, automated phishing campaigns Your own dashboard with real-time statistics Hundreds of ready-made templates in 30+ languages Continuous, automated campaigns Integrated micro-learnings after every click failure
	From €3,000 per campaign	Available as a monthly retainer

Not sure which model fits? Free consultation in 15 minutes.

Attack scenarios

Typical scenarios from our campaigns

Every scenario is individually tailored to your organisation - from the sender address to the pretext:

CEO Fraud / BEC

Business Email Compromise · Wire Fraud

Spoofed instructions from senior management. Test whether your finance team responds to fraudulent wire transfer requests.

Credential Harvesting

Fake Login · M365 Phishing

Fake login pages for Microsoft 365, VPN portals or internal tools. How many employees enter their credentials?

Malware Simulation

Payload Delivery · Macro Documents

Fake invoices, applications or supplier emails with simulated malicious attachments - without any real risk.

QR Code Phishing (Quishing)

Quishing · Physical Vector

Manipulated QR codes on posters, in meeting rooms or on business cards. We also test physical attack vectors.

Spear Phishing

OSINT · Targeted Attack

Highly personalised attacks on specific individuals or departments - with OSINT research and tailored pretexts.

Custom scenario?

We develop industry-specific scenarios to your specifications.

Discuss scenario

Comparison

Manual vs. Managed - the comparison

Both models have their strengths. The ideal solution? Often a combination - manual baseline test, then managed for ongoing operations.

	Manual Simulation	Managed Platform
Scenarios	Individually handcrafted	Hundreds of ready-made templates
Support	Dedicated point of contact	Self-service + support
Frequency	1-4x per year	Continuous / automated
Languages	German & English	30+ languages
Reporting	Management report as PDF	Real-time dashboard
Ideal for	Baseline & deep-dive test	Ongoing operations & measurement

Maximum impact? Manual baseline test + managed retainer for ongoing operations.

How it works

From enquiry to campaign in 5 steps

StepPhaseWhat happens

01
Briefing & Goal Definition

Together we define target groups, scenarios and success metrics. Which departments will be tested? Which attack scenarios are realistic for your organisation?
02
Campaign Design

Our social engineering experts develop tailored phishing emails, landing pages and pretexting scenarios - aligned to your company structure and industry.
03
Execution & Monitoring

The campaign is rolled out and monitored in real time. We capture open rates, click rates, credential entry rates and reporting rates.
04
Analysis & Report

Detailed results report with benchmarks, department comparisons, risk assessment and concrete recommendations for action.
05
Sustainable Improvement

On request, we support you with regular follow-up campaigns. Security awareness is not a one-off project - it is a continuous process.

GDPR & Compliance

Privacy-by-design as standard

Phishing simulations involve personal data - which is why GDPR compliance is not an afterthought for us, but a core component of every campaign.

Anonymised

Anonymised evaluation

Results at department level only

Works council

Works council-ready

Pre-coordination with works council & DPO

Privacy

No individual exposure

Individuals are never identified

Germany

Data stored in Germany

Infrastructure on German servers

Request simulation

References

Successful phishing campaigns

These case studies are available in German.

01 Managed Phishing Simulation Windhoff Group Read case study (German) 02 Managed Phishing Simulation LOTTO Bayern · Spielbanken Bayern Read case study (German)

Certification: ISO/IEC 27001 certified
Qualification: BSI-qualified
Data protection: GDPR-compliant
Experience: 500+ campaigns conducted

Related services

Phishing simulation as part of your awareness strategy

Simulations have the greatest impact when combined with other measures:

Live Hacking Show

Kick-off before the simulation - your employees experience live how attackers operate.

Details 02

Escape Desk

Gamified security training - employees solve security challenges in a fun, competitive format.

Details 03

Penetration Testing

Test the technical side - our pentesters find vulnerabilities in your systems.

Details

Why organisations trust AWARE7

What sets us apart from other providers

Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.

Research and teaching as our foundation

20 %

Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.

Digital sovereignty: no compromises

100 %

From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.

Fixed price within 24h: predictable project timelines

24 h

Within 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.

Your dedicated contact

1:1

A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.

Peer-reviewed publications

Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations

ACM AsiaCCS 2025

Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

A Platform for Physiological and Behavioral Security

NSPW 2025

Jan Hörnemann

Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem

IEEE/IFIP DSN 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Understanding Regional Filter Lists: Efficacy and Impact

PoPETS 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Who is AWARE7 the right partner for?

Mid-sized companies with 50-2,000 employees

Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.

IT managers & CISOs

Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.

Regulated industries

Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.

Organisations that rely on AWARE7 phishing simulations

Your phishing experts

Our social engineering specialists develop realistic campaigns for your organisation.

Chris Wojzechowski

Managing Director

E-Mail

PGP 465C26E1AF161AFA

Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.

IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK) T.I.S.P. Board-Mitglied

View full profile

Jan Hörnemann

COO

E-Mail

PGP A3FD64BB96C888E2

M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.

ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)

View full profile

Target groups

Who benefits from a phishing simulation?

Phishing attacks target every industry and every level of the hierarchy. These groups benefit most.

All employees

Every employee is a potential entry point. Broad campaigns show where the greatest risks lie within the organisation - cross-departmental and reported anonymously.

Executives & C-level

CEO fraud and Business Email Compromise target decision-makers directly. Spear phishing scenarios with personalised context test exactly the attack vectors most commonly used at executive level.

Finance & HR

Accounting and HR manage sensitive data and payment approvals. Attackers use fake invoices, IBAN changes and malware-laden job applications. Targeted scenarios for these departments are particularly effective.

IT departments

Even IT professionals are not immune to social engineering. Technically sophisticated attacks - such as fake support requests, vendor impersonation or manipulated update links - test security behaviour exactly where privileged access is managed.

NIS-2 affected organisations

The NIS-2 Directive requires technical and organisational measures to demonstrate attack resilience. Regular phishing simulations are a verifiable component of an ISMS and support compliance documentation with supervisory authorities.

Organisations after a phishing incident

Companies that have already been targeted have a particular need for action. A post-incident simulation analyses which gaps exist in the human security layer - and provides the foundation for a targeted training programme for lasting improvement.

“We thought our employees knew what phishing looks like. The simulation by AWARE7 proved us wrong - and in a way that does not single anyone out, but creates lasting awareness. Three months later, we had halved the click rate.”

Role: Information Security Officer
Organisation: Public authority, NRW - 1,200 employees

Frequently asked questions

Your questions about phishing simulation

What is a phishing simulation?

A phishing simulation is a controlled test in which realistic but harmless phishing emails are sent to your employees. The goal is to measure current awareness levels and improve them in a targeted way - without any real risk to your organisation.

What is the difference between manual and managed phishing simulations?

In a manual simulation, our experts develop individual, handcrafted phishing scenarios with personal support throughout the campaign. With a managed simulation, we provide you with a professional platform (phished.io) that allows you to run campaigns independently on an ongoing basis.

Are employees informed beforehand?

That depends on your strategy. We generally recommend an unannounced initial test to get a realistic baseline result. Awareness measures can then be communicated and progress measured with follow-up tests.

How realistic are the phishing emails?

Very realistic. Our experts use current attack techniques that real attackers also use: spear phishing with personalised content, fake login pages, CEO fraud scenarios and industry-specific pretexts.

How much does a phishing simulation cost?

Costs depend on scope and model. A one-off manual campaign starts from around €3,000. Managed phishing via phished.io is available as a monthly retainer model. We will provide you with an individual quote within 24 hours.

Is a phishing simulation GDPR-compliant?

Yes. We work exclusively with anonymised results at department level. Individuals are never identified or exposed. The simulation is coordinated with your works council and data protection officer beforehand.

How often should phishing simulations be conducted?

For sustainable results, we recommend at least quarterly tests. Studies show that click rates return to baseline levels within 6 months after a single campaign. Continuous campaigns keep awareness permanently high.

Which industries benefit most from phishing simulations?

Fundamentally, any organisation is a potential target. Particularly at-risk industries include financial services, healthcare, public authorities, critical infrastructure operators and industrial companies. NIS-2-affected organisations also have a legal obligation to demonstrate technical and organisational measures for attack resilience.

What happens if employees click on a simulated phishing email?

They are redirected to an awareness landing page that explains what just happened and which warning signs the email contained. No blame, no pressure - instead a learning moment right at the moment of the mistake. This "just-in-time training" is demonstrably more effective than traditional e-learning modules.

Can the phishing simulation be coordinated with our works council?

Yes, and this is strongly recommended. We support you with a sample works agreement template and advise you on presenting the project. The key point: only anonymised department-level results are reported. Individual employees are never identified or sanctioned.

Aus dem Blog