We send realistic phishing emails to your employees and analyse who opens them, who clicks, who enters credentials and who reports them.
GDPR-compliant, no real data
Results within 48 hours
Results without names
16%of breaches start with phishing, 6% with pretexting
1 in 3untrained employees fall for simulated phishing
< 60 sec.from opening the mail to entering credentials (median)
4%susceptibility after 12 months of training (before: 33%)
Sources: Verizon DBIR 2026/2024, KnowBe4 2026 (vendor data). What happens at your organisation, only your own campaign shows.
The simulation email, taken apart
Example. Every campaign is built from scratch for your environment.
1Fromit-support@your-company-co.com
2SubjectUrgent: your password expires in 24 h
4Attachment
Password-Policy.pdf
3Renew password now
Simulated email · not a real attackExample
5
Login page, run by us
Looks like M365, the VPN portal or your intranet. Or simply a notice page instead: this was a test.
1
PreparationSender and domain
A domain that resembles yours, or a well-known service such as Microsoft or DHL. We set it up ourselves.
2
Open rateSubject with a deadline
It decides whether the email gets opened at all. That is how we judge how well it worked.
3
Click rateLink and button
Anyone who opens the link is recorded. The key figure.
4
Attachment openedDocument attached
Word, Excel or PDF with simulated macros. No malicious code, but we see who opens it.
5
Credential entryThe page behind the click
Anyone who types a username and password here shows the real risk of a data leak. We do not store real passwords.
The most important figure is not in the email
The report rate. Anyone who passes the attempt on to IT instead of ignoring it turns an incident into a warning for everyone else. It is the only rate that should go up, and it says more about your security culture than any click figure.
Six scenarios
Standard campaignEntry level · Benchmark
Sent to everyone or to selected departments. Delivers the overall click rate as a baseline.
Spear phishingExecutives · Accounting · IT
Personalised with name, role and real project references. This is how APT groups work.
CEO and payment fraudFinance · Management
A simulated payment order from the board. Shows whether dual control and callback rules are actually followed.
Credential harvestingM365 · VPN · AD
After the click comes the deceptively real login page. We capture every entry made there.
Attachment and macroOffice · PDF
Macros and links in the document, no malicious code, fully tracked.
Departments, scenarios, exclusions and the legal framework.
2
Building the campaign
Emails, domains, landing pages and tracking for your environment.
3
Execution
Sent on schedule. We monitor continuously and get in touch immediately.
4
Analysis
All tracking data broken down by department, location and scenario.
5
Report
Audit-ready, with industry comparison, risk groups and measures.
What the report contains
Click, entry and report rates, broken down by department, location and scenario
Industry comparison and the risk groups you should start with
When the clicks happened: in the morning, under time pressure, just before the end of the day
Management summary and concrete measures, usable for audit documentation
We deliver the simulation and the evidence, not legal advice.
What the results look like
Phishing report · Acme LtdExample figures
Overall click rate31%
Credential entry (fake login)14%
Highest risk groupAccounting 48%
Report rate (correctly identified)8%
Average of all industries before training (KnowBe4)∅ 33%
Priority 1 recommendationPhishing reporting process
An example of how the report is structured, not measured values (except for the KnowBe4 comparison). The report rate of 8% would be the first place to start, the target is above 60%.
How often
Two to four simulations a year with changing scenarios keep awareness high. For audits, what counts is that you measure awareness regularly and adjust.
What happens next
The click rate alone changes nothing. We go through the figures with you and work out what makes sense next: a refresher for everyone, training for the departments that stood out, or a live hacking session that recreates exactly this email. More at access-granted.de/en/training.
Frequently asked questions
May we test without announcing it?
Yes, that is the point: announced, the test only measures the caution right afterwards, not everyday behaviour. It is permissible within a clean framework: works council involved, results only at group level.
How realistic are the emails?
We write them by hand and research your tool stack, language and current projects via OSINT beforehand. Templates are no good for this.
How is this different from an awareness platform?
Platforms send mass simulations from templates. With us, every scenario is built for your organisation, and at the end you get an audit-ready report instead of a dashboard.
Can this be combined with a Physical Pentest?
Yes. Email, credential entry, physical access with the captured data, movement through the network. We build chains like this on request.
How many on your team click?
In a free initial call we agree scope and scenarios.
