Phishing Simulation Software & Security Awareness Testing for UK & International Businesses
Phishy sends realistic phishing simulations to your team by email, SMS and QR code, then shows you exactly who clicked, who entered credentials, and how your human-risk score changes over time. Run a phishing test in under an hour and get a board-ready report. No annual contract, built for growing businesses in the UK and worldwide.
Source: UK Government (DSIT), Cyber Security Breaches Survey 2025/26.
Three attack channels, one platform
Test every way attackers actually reach your staff
Email phishing
Realistic spoofed emails from familiar brands — IT helpdesk, payroll portals and Microsoft 365 — to test how staff respond to the most common attack.
SMS smishing
Text-based phishing tests that measure whether employees follow links from unexpected senders on their phones.
QR quishing
QR codes in emails or printed documents — a fast-growing attack vector most phishing-simulation tools still ignore.
How it works
From sign-up to board-ready report in five steps
Upload your employees
Import your team via CSV or add them manually, and group by department for targeted campaigns.
Choose a template and channel
Pick from 16+ realistic landing pages — IT helpdesk resets, payroll alerts, Microsoft login clones and more.
Set your send schedule
Send all at once, stagger by time, spread evenly across a window, or limit to business hours.
Watch results in real time
Your dashboard tracks opens, clicks and credential submissions the moment they happen.
Download your PDF report
A full breach report with risk score, per-employee breakdown, timeline and scoring methodology — ready for leadership and auditors.
Why Phishy
Enterprise-grade testing, built for teams of 10 to 2,000
Enterprise platforms (KnowBe4, Cofense)
- ✕Annual contracts, often £10k–£50k+
- ✕Complex onboarding, weeks to launch
- ✕Overkill for teams under 500 people
- ✕No QR/quishing or SMS out of the box
Phishy
- ✓Simple monthly pricing, no lock-in
- ✓Up and running in under an hour
- ✓Built for SMBs worldwide, 10 to 2,000 staff
- ✓Email, SMS, QR and voice in one platform
- ✓GDPR-conscious: passwords are never stored
Transparent pricing
Monthly plans, or a done-for-you pilot to start
Run a pilot
Not ready for a subscription? We will run one for you
A pilot is the fastest way to find out where you stand: one real campaign sent to your actual employees on a live simulation domain. We set it up and run it with you, then walk you through the full PDF report on a call, ready for your board or IT team. No subscription required.
In every report
A risk score your leadership will actually read
Risk score
A single 0–100 score weighted by credential submissions (×70) and link clicks (×30) — easy to track across repeat campaigns.
Per-employee breach detail
Everyone who interacted gets their own page: what they did, when, and which fields they submitted.
Campaign timeline
A visual log of every send, open, click and submission, plotted across the campaign window.
Scoring methodology
A plain-English explanation of how the score was calculated — suitable for leadership, auditors or insurers.
FAQ
Phishing simulation, answered
What is a phishing simulation?
A phishing simulation is a controlled, safe phishing test sent to your own employees to measure how they respond to realistic scam emails, texts or QR codes. No real harm is done — Phishy records who clicked or submitted credentials so you can train the people who need it and prove your security-awareness progress over time.
Do my employees know it’s a test?
Not during the campaign — that’s the point. Afterwards, anyone who clicked or submitted credentials can be shown an awareness page explaining what happened and what to watch for next time.
Do you store the passwords employees enter?
No. Phishy records that credentials were submitted but never stores the actual username or password. This is a deliberate design decision for GDPR compliance.
Will the simulation emails land in spam?
Simulation emails are sent from SPF/DKIM/DMARC-verified domains. If you use Microsoft 365 Defender, we’ll guide you through the Advanced Delivery Policy allowlist — a 5-minute step that ensures nothing gets quarantined.
Is phishing simulation legal in the UK?
Yes. Phishy operates under a formal Authorised Testing Terms agreement. All legal documents — DPA, Privacy Policy and AUP — are drafted under the Data (Use and Access) Act 2025 and available at phishy.wolfcore.co.uk/legal before you sign up.
How much does phishing simulation software cost?
Phishy starts at £99/month for up to 50 employees. Business is £299/month for up to 250, and Pro is priced by headcount from £399/month. Pay yearly and get 2 months free. Prefer no subscription? A done-for-you pilot starts at £249. No annual contract is required.
Ready to see how your team holds up?
Launch your first phishing simulation in under an hour. No annual contract, cancel any time.