Find out how many of your people would click, how many would hand over a password, and how many would report it. We run controlled phishing campaigns across your workforce, measure the real behaviour, and turn the result into a plan your board can sign off.
Phishing simulation is a controlled exercise in which we send realistic but completely harmless phishing emails to your employees, under written authorisation from your organisation. Nothing is installed, no malware is used, and no real credential is ever captured or stored. What we capture is behaviour: who opened the email, who clicked the link, who went on to type a password into the landing page, and critically, who recognised the attempt and reported it.
A campaign typically runs over one to two weeks across your whole workforce or a defined population. Templates are modelled on the lures that actually land in Malaysian inboxes: e-invoice and LHDN notices, DuitNow payment requests, HR payroll and EPF letters, courier delivery notifications, Microsoft 365 password expiry warnings and internal IT service desk messages.
Anyone who clicks lands on a short coaching page rather than a scolding, explaining the specific red flags in the email they just received. The teaching moment happens at the exact second the mistake is made, which is when it sticks.
Email remains the most common way into an organisation, because it targets the one control you cannot patch. Attackers do not need to defeat your firewall if a member of your finance team will open the door for them.
The 2024 amendments to Malaysia's Personal Data Protection Act tightened the consequences. A personal data breach now has to be notified to the Commissioner, and affected individuals told where there is significant harm, on a timeline measured in days not months. Regulators, auditors, cyber insurers and enterprise clients running vendor assessments increasingly ask the same question: how do you know your staff can spot a phishing email? "We ran a training session" is not an answer. A measured click rate, a trend over four quarters and a documented remediation plan is.
Simulation also tells you where to spend. Most organisations discover their risk is not evenly spread. One department, one branch or one shift pattern will carry most of the exposure, and that is where the budget should go first.
Every campaign produces the same core metrics, so you can compare this quarter against last quarter, and one business unit against another, without arguing about methodology.
Templates built around lures your staff genuinely receive, in the tone and format they expect. We agree difficulty in advance, from an obvious mass-mail attempt through to a targeted message referencing your real suppliers, systems and internal terminology.
Every open and click is logged with a timestamp, device type and whether the interaction happened on a corporate machine or a personal phone. Time-to-click matters as much as the raw number: the staff who click within sixty seconds are the ones a real attacker gets to first.
The most serious signal is not a click, it is a password. Our landing pages record that a submission was attempted and discard the value immediately. We never see, store or transmit the actual credential, and the report shows submission counts, never passwords.
The metric most programmes ignore and the one that shortens a real incident. We measure how many staff reported the email, how quickly, and through which channel, then help you set up a one-click report button so reporting is easier than deleting.
Results are broken down by department, branch, seniority, tenure and role so you can see exactly where the exposure sits. Finance, HR and customer-facing teams usually look different from engineering, and new joiners usually look different from everyone.
A one-page summary written for a board audience: current risk position, movement since the last campaign, the three actions that would move the number most, and how you compare against organisations of similar size and sector.
The point of a simulation is not to catch people out. It is to give management a number they can manage, and to shorten the gap between an attack landing and someone raising the alarm.
Most leadership teams believe their staff would spot a phishing email. A first campaign settles the argument in a fortnight and gives you a baseline to improve against.
Department-level results let you target intensive coaching at the twenty percent of the workforce carrying most of the exposure, instead of paying for the whole company to sit through the same session again.
Campaign reports, remediation plans and trend data form a documented record that your organisation actively manages human risk. That record matters during a Commissioner enquiry, an ISO 27001 audit, a client vendor assessment or a cyber insurance renewal.
An organisation where staff report suspicious email in four minutes contains an incident very differently from one where the first sign of trouble is a customer complaint three weeks later.
Senior staff are the highest-value targets and usually the least tested. Simulation surfaces that gap quietly, before it is discovered the expensive way.
When a training session is scheduled off the back of real results from your own people, attendance, attention and retention all change. See our cybersecurity awareness training programmes for the follow-through.
A first engagement runs about four to six weeks end to end, including scoping and the debrief. Follow-up campaigns are faster because the groundwork is already done.
We agree the population, the campaign difficulty, the schedule and the rules of engagement, including which teams are excluded and what happens if someone escalates to the police or a bank. Your authorised signatory signs off before anything is sent. This document is what makes the exercise lawful and it protects both sides.
We whitelist the sending infrastructure with your IT team so simulated mail reaches inboxes rather than being silently filtered, register the landing domains, and run a small pilot to a test group to confirm delivery, tracking and the coaching page all behave correctly.
The first campaign is deliberately unannounced and pitched at a realistic difficulty. Announcing it produces a flattering number that tells you nothing. Emails are released in waves over several days so that early clickers cannot warn the rest of the office.
We watch results as they come in and flag anything that needs an immediate response, for example a genuine credential compromise discovered along the way. Staff who click see a short coaching page straight away, framed as guidance rather than punishment.
Raw data becomes three outputs: an operational report for IT and security, a department heat map for line managers, and a one-page executive summary for the board. We walk your team through all three in a debrief session.
We agree the follow-up actions, typically targeted training for high-risk groups, a reporting button rollout, and a technical control or two. Then we schedule the next campaign, because a single data point is a curiosity and a trend line is a programme. Continuous delivery is covered under human risk management.
Everything is delivered as documents you own and can circulate internally, not as a dashboard login that expires when the engagement ends.
Full campaign results with click rate, credential submission rate, report rate, time-to-click and time-to-report, set against sector context.
A visual comparison across business units, locations and seniority bands so managers can see their own position at a glance.
Written for directors and audit committee members. No jargon, one risk position, three recommended actions.
A prioritised ninety-day plan covering training, process and technical controls, with an owner and an effort estimate against each item.
The coaching pages, red flag reference cards and internal comms templates used during the campaign, yours to reuse.
Where the campaign is combined with a formal awareness session, participants receive certificates that can be verified through our certificate verification page.
Any organisation where staff use email can benefit, but the return is highest where a single mistaken click leads directly to money moving or personal data leaving.
We run campaigns across regulated and unregulated sectors. Regulated organisations tend to need the documentation trail as much as the result itself.
Campaign design changes with headcount. Under fifty people we usually run a single wave; above a thousand we segment by business unit so line managers get results they can act on.
Whole-workforce campaigns give the truest picture, but these functions are where an unnoticed click causes the most damage.
Plenty of vendors will sell you a phishing platform. Fewer will sit with your risk committee afterwards and explain what the number means.
We approach phishing simulation as a governance activity, not a technical stunt. The output is designed to feed your risk register, your audit evidence pack and your board reporting cycle, which is where it has to land for anyone to act on it.
Every finding comes with a recommendation someone in your organisation can actually own, sized against the resources you have. We will not hand you a forty-page report recommending a security operations centre if you have two people in IT.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Awareness training that follows a simulation can be delivered as an HRD Corp claimable programme through our registered training arm, which for levy-contributing employers makes the follow-through close to cost-neutral. See HRD Corp claimable cybersecurity training.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
