Simulation systems online

KNOW THE THREAT.
COUNTER THE THREAT.

Every phishing attack is a bet that you won't look twice. Learn to see the hook before it sets - and the outcome stops being the attacker's to decide.

Start the training - free

Threat feed

WATCHQR-code phishing aimed at delivery and logistics staffWATCHMFA-fatigue push bombing paired with fake IT helpdesk callsADVISORYFake DocuSign login pages harvesting Microsoft 365 credentialsTRENDDeepfake voice calls reinforcing fraudulent payment requestsWATCHTurnkey invoice-fraud kits circulating on TelegramTRENDHijacked reply chains - the phish arrives inside a real threadWATCHQR-code phishing aimed at delivery and logistics staffWATCHMFA-fatigue push bombing paired with fake IT helpdesk callsADVISORYFake DocuSign login pages harvesting Microsoft 365 credentialsTRENDDeepfake voice calls reinforcing fraudulent payment requestsWATCHTurnkey invoice-fraud kits circulating on TelegramTRENDHijacked reply chains - the phish arrives inside a real thread

For you

I want to train myself.

The Phishing Analyst path, sixty-second practice and an earned certificate. Runs in your browser, nothing leaves your device, costs nothing.

Start freeNO ACCOUNT · SAVE AND RESUME

For your company

I run a company.

NIS2 made staff training a legal duty across the EU. Exposure checks, simulated attacks, and a training register an auditor accepts.

See how it worksFIRST STEP IS FIXED-PRICE

Would you have caught it?

Nothing here is hidden. That is the point.

Every tell in this message was visible to anyone who slowed down for three seconds. Tap one - in the message or in the list - and see what it was signalling.

SPECIMEN · CAPTURED IN THE WILD

FROM

SUBJUnusual sign-in activity -

We detected a sign-in to your account from an unrecognised device in Lagos, Nigeria. For your protection, some features have been limited until your identity is re-verified.

Verify my account

Button target:

Five tells in one message. Real ones rarely show more than two.

Train it

More like this, with the full playbook behind each one, in the threat library.

Training

Free · certification path$ ./phishing_analyst --start

PHISHING ANALYST

Eight blocks on how scams are actually built - the inbox, the fake call, the QR trap, the stolen account - each closed by an exam you cannot bluff. Finish it and the certificate is verifiable, because the score behind it is real.

Start the path - free~2 HOURS · SAVE AND RESUME ANY TIME

$ ./practice --quick

PRACTICE

Sixty-second scenarios pulled from live attacks. Score yourself before someone else does.

ENTER→

$ cat threats/

THREAT LIBRARY

Schemes running in the wild right now - how each is built, and where its seams show.

ENTER→

$ ./certificate --verify

CERTIFICATE

Eighty percent or nothing. Verifiable by anyone with the code, because the score behind it is real.

ENTER→

NIS2 · across Europe

Since 2026, training your staff is not good practice. It is the law.

SECTORS IN SCOPE

EU STATES, ONE DIRECTIVE

24 h

TO REPORT AN INCIDENT

NIS2 in plain English WHAT AN AUDITOR GETS FROM US

8 + 4modules

learning blocks and exams on the Phishing Analyst path, the final one included

4playbooks

real schemes in the threat library, each taken apart line by line

100%

free - no signup, no upsell, everything runs inside your browser

80% or nothing

the pass mark. The certificate is earned, never bought

Exposure check · €190

See what an attacker sees before they use it.

Tell us the domain. You get one page on what is publicly exposed around your company, at a fixed price, within two working days. No call, no demo, no subscription.

KNOW THE THREAT.COUNTER THE THREAT.

I want to train myself.

I run a company.

Nothing here is hidden. That is the point.

PHISHING ANALYST

PRACTICE

THREAT LIBRARY

CERTIFICATE

Since 2026, training your staff is not good practice. It is the law.

See what an attacker sees before they use it.

KNOW THE THREAT.
COUNTER THE THREAT.