Campaign studio
Build, schedule, and adapt phishing simulations for different regions, roles, and risk profiles.
Phishing simulations
Phishing simulations that look like the real thing
Send realistic, localized phishing emails to your own people, measure who opens, clicks, submits credentials or reports, and turn every result into numbers your leadership and auditors can read.
- First campaign free, no credit card
- Slovak, Czech and English templates
- Microsoft 365 and Google Workspace
How a campaign works
Realistic lures, safe landing pages, live results
Every campaign starts from a lure written by the offensive-security team at Haxoris in Slovak, Czech and English business language, so it reads like the real thing. You choose who receives it and when, and every open, click, submission and report appears as it happens.
- Lures your people could get this week: invoices, payroll, QR codes, shared documents, login prompts
- Users from Microsoft 365 or Google Workspace, segmented by team, language, seniority or exposure
- Staggered delivery and safe landing pages that collect no real credentials
- Click, submission, report and repeat-risk trends per team, exported as a branded PDF
Capabilities
Everything you need to run a phishing campaign
Each capability covers one step of the campaign loop, so a lean security team can run a full simulation program without a dedicated administrator.
Template library
Use scenarios inspired by real-world payroll, supplier, invoice, QR, credential, and collaboration-platform lures.
Targeting and scheduling
Segment by team, language, seniority and exposure, then stagger delivery with throttling so campaigns look like real mail, not a mass blast.
Safe landing pages
Every click lands on a controlled page that never stores what is typed. If an employee submits, the page turns into a learning moment that explains what just happened and why it matters.
Phishing report button
Capture suspicious emails from employees and turn reporting into a measurable security habit.
Live results dashboard
Watch opens, clicks, credential submissions and reports arrive in real time, broken down by campaign, team and department.
Simulation engine
Realistic campaigns without manual campaign busywork
Create scenarios that match employee context, then schedule them as a repeatable program instead of one-off tests.
- Role-based and department-based campaign targeting.
- Localized lures for different languages, teams, and business patterns.
- Safe landing pages that explain what happened and why it matters.
Measurement
Readable training and risk metrics for security and leadership
PhishGun separates vanity completion numbers from the behaviours that reduce risk: spotting, reporting, training, and improving.
- Click, report, training completion, and repeat-risk tracking.
- Team-level views for targeted intervention and follow-up training.
- Exportable evidence for compliance and management reporting.
Phishing content
A wide library of templates and advanced scenarios
Pick from a growing collection of public and locally prepared phishing templates - from everyday lures to advanced attacker tradecraft - so simulations stay realistic for every team.
- Credential harvesting, credit card, invoice, and HR-themed lures.
- Browser-in-the-browser, OAuth consent, and MFA-fatigue scenarios.
- Advanced attacker tradecraft like ClickFix and conditional landing pages.
- Localized template packs adapted to language, region, and industry.
Reporting
Audit-ready reports your stakeholders actually read
Turn campaign results into clean, branded reports for leadership, auditors, and partners - without spending hours assembling slides.
- Branded PDF exports with campaign summaries and risk trends.
- Compliance-ready evidence aligned with NIS2, ISO 27001, and DORA reviews.
- Per-team and per-department breakdowns for management reporting.
Campaign lifecycle
From import to report in five steps
A first campaign takes about five minutes to brief from a localized template. The same loop then repeats on a schedule you set.
Import and segment
Sync users from Microsoft 365 or Google Workspace and group them by team, language and risk profile.
Pick a scenario
Choose a localized template from the library or adapt one to a current threat or business event.
Schedule the send
Pick the send window and PhishGun paces delivery so the campaign lands in inboxes like everyday mail.
Watch results live
Opens, clicks, credential submissions and reports appear as they happen, with the learning moment triggered automatically on a submission.
Export the evidence
Turn the campaign into a branded PDF report and a trend line for the next management review or audit.
After the mistake
Every simulation feeds straight into employee training
A phishing test that ends at the click rate is a measurement, not a program. In PhishGun the moment an employee submits data to the simulated page is the start of training: they are told nothing was stored and shown what they missed while the message is still fresh.
- In-the-moment micro-training on the exact signals the employee missed.
- Full training modules with quiz questions, assigned from the library or built on your own guidelines.
- Positive feedback for employees who report instead of clicking.
- Training completion and repeat risk tracked next to the click rate.
Use cases
One product, many program shapes
PhishGun adapts to the team running the program. Start as a focused phishing simulation and employee training tool and grow into a broader awareness rhythm as the program matures.
NIS2 and ISO 27001 readiness
Show recurring awareness activity, employee participation, and risk trend evidence for management reviews and audits.
SMB and mid-market security
Run a credible phishing simulation and employee training program without buying an oversized enterprise suite or adding a dedicated admin role.
Executive and finance risk
Target high-impact groups with realistic invoice, supplier, payroll, and credential-theft simulations.
Manufacturing and operations
Train mixed desk and frontline employees with concise, localized scenarios that do not rely on long courses.
Remote and hybrid workforce
Reinforce secure behaviour across distributed teams using email, collaboration, QR, and credential scenarios.
Compliance and governance teams
Produce participation, behaviour, and training evidence ready for board, audit, and regulator conversations.
Integrations
Works with the tools your teams already use
PhishGun is designed around common business stacks, with simple paths for identity, email, reporting, and ticketing workflows.
Resources
See phishing simulations in practice
How campaigns are built, what the lures look like, and the click rates to compare your results against.
How to Run a Phishing Simulation: A Practitioner's Step-by-Step Playbook
How to run a phishing simulation step by step: set the goal, pick a realistic scenario, launch to a representative group, then measure click rate, report rate and time to report.
12 Real Phishing Email Examples for Employee Training (Annotated)
12 annotated phishing email examples from real campaigns - parcel scams, bank lures, fake CEO requests and AI-written attacks. Train your team to spot them.
Phishing Click Rate Benchmarks: European Data and What Good Looks Like
Phishing click rate benchmark data for 2026: untrained employees click 33%, trained teams 5%. Compare your results by industry and size - see how you stack up.
Phishing simulation questions
Short answers for teams planning their first campaign.
Yes. Simulated emails carry no malware, landing pages never store real credentials, and every campaign runs with throttling, controlled content and full administrator visibility. Employees who fall for it see an explanation, not a penalty.
About five minutes from a localized template once users are imported from Microsoft 365 or Google Workspace: pick the scenario, choose the recipients, set the send window and launch.
Templates, landing pages and training are available in Slovak, Czech and English, written in local business language rather than translated from English, so the lure is a fair test of what employees would see in a real attack.
Click rate, credential submission rate, report rate and repeat risk per team and department, a branded PDF report, and a trend line across campaigns you can hand to leadership or an auditor.
Next step
See a phishing simulation run end to end
Book a 30-minute demo: we build a campaign from a localized template, send it, and walk through the results and the report with you.