Security awareness training
PhishGun gives you both kinds of employee training: a library of ready-made training modules you assign to employees and track to the score, and short, localized micro-training delivered the second someone submits a password to a simulated phishing page. Add your own modules built on your internal guidelines, and every result becomes evidence of a working awareness program.
How it works
A yearly e-learning course produces records, not behaviour change. PhishGun keeps the structure a program needs and adds the lesson at the moment it matters.
Ready-made modules from the library, or your own built on your internal guidelines.
When an employee submits data to the simulated page, it turns into a short lesson about that exact message.
Training capabilities
PhishGun covers both kinds of employee training: structured modules you assign and score, and the lesson that appears the moment someone submits data to a simulated page. Both feed the same record of who was trained, when and with what result.
Ready-made modules on phishing, social engineering, credential safety, data protection and incident reporting, each a few pages plus quiz questions, filterable by category and language.
Assign modules to individual employees or whole teams, then see who finished, who has not started and what score each person achieved.
Build your own training modules around your internal security guidelines, processes and tools, so employees are trained on how your organisation actually works, not a generic course.
Submitting data to the simulated page opens a short lesson about the exact message the employee just fell for: the sender, the urgency, the link or the login page they should have questioned.
Employees who report a simulation instead of clicking are told they got it right, which turns reporting into a habit rather than a chore.
Export who was trained, when and with what result, together with campaign behaviour, as evidence for NIS2, ISO 27001 clause 7.3 and DORA awareness reviews.
Training library
The Trainings library is the structured part of the program. Pick a module, assign it to the people or teams who need it, and follow completion and scores from the Assignments view instead of chasing spreadsheets.
The teachable moment
The page an employee sees after submitting a password to the simulated login is not a dead end or a reprimand. It confirms that nothing they typed was stored, then walks through the signals that gave the message away, one at a time, on top of the very email they opened - in their language, with what to do when the real thing arrives.
Follow-up
Completion numbers hide the people who still click. PhishGun shows training completion, improvement between campaigns and repeat risk side by side, by team and department.
Evidence
Regulators and certification auditors ask for proof that employees are trained regularly and that the training is effective. PhishGun exports both: participation and training completion, plus the measured behaviour change behind it.
Training flow
Training reaches employees two ways: modules assigned by you and lessons triggered by their own behaviour. Both end up in one record.
An employee or team receives a training module from the library or one of your own, works through its pages and answers the quiz questions.
A localized lure lands in the inbox during a normal workday, with no warning and no classroom.
The click lands on a safe page. If the employee submits, nothing is stored and the page turns into a short explanation of the message and the signals it contained.
An employee who reports the message through the report button is told they did the right thing.
Module completion and scores, improvement and repeat risk are recorded per person and team, and the training record goes into the report for leadership, auditors and regulators.
Compliance
Awareness training is a named obligation in the main European frameworks. PhishGun gives you the participation and effectiveness evidence each of them expects.
Essential and important entities must apply basic cyber hygiene practices and cybersecurity training, and management must follow training and offer it to employees regularly. Simulation and training records show the duty is met and the training works.
Clause 7.3 requires employees to be aware of the security policy and their role in it; control A.6.3 requires awareness, education and training. Completion and behaviour records are the evidence certification auditors ask for.
Financial entities must run ICT security awareness programmes and digital operational resilience training as compulsory modules for staff. Repeated simulations with training provide the ongoing record.
Trust principles
PhishGun is built by offensive-security practitioners who understand both realistic attacker behaviour and the trust needed to run awareness programs well.
Collect the data needed to measure security behaviour while keeping program reporting focused and proportionate.
Reward reporting and teach missed indicators without public shaming or punitive workflows.
Run simulations with controlled landing pages, clear admin visibility, and realistic but safe content.
Produce practical evidence of recurring awareness activity for governance and audit discussions.
Resources
The NIS2 and ISO 27001 training duties, and how a phishing test proves the training works.
NIS2 security awareness training requirements under Articles 20 & 21(2)(g), Slovak and Czech decrees, evidence, fines and a 12-month plan. Get compliant now.
ISO 27001 security awareness training requirements explained: Clause 7.3 vs Control A.6.3, frequency, and the evidence auditors sample. Get audit-ready today.
How a phishing test for employees works step by step, what it costs, and what a good report contains. Run your first phishing campaign free - no credit card.
Short answers for teams comparing training approaches.
Next step
Book a 30-minute demo and walk through the module library, an assignment with its scores, the simulated email, the lesson that follows a submitted password and the training evidence in the report.
