Find out which of your staff would fall for a phishing email
Run a real phishing simulation on your own team with Phishy. See who opens, who clicks and who types in a password, then get a report you can take to the board.
Start my free 14-day trial How it worksFor organisations only. Sign up with your company email; Gmail, Outlook and other personal addresses will not work.
What you get in 14 days
- Your real click rate, not a guessSee who opened, who clicked and who typed in a password, person by person, as it happens.
- Tests that look like real attacksMicrosoft 365, payroll and IT helpdesk lures, and you can clone your own login page to make it convincing.
- Phones tested too3 SMS phishing tests, because attackers text your staff as well as email them.
- A report the board will readA PDF with a risk score and per-person results, ready for Cyber Essentials, ISO 27001 or your insurer.
- Staff learn at the right momentAnyone who clicks sees a short lesson straight away, while it still matters.
- Safe by designPasswords are never stored, and tests can only reach your own company domain.
- No card, no catchUp to 10 staff, nothing renews, and a UK team to help if you get stuck.
Why test your staff?
Phishing is the attack UK businesses run into most. The government's Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses reported a breach or attack in the last 12 months, and phishing was the most common and the most disruptive kind.
Know your real risk
Training slides tell you what staff know. A simulation shows you what they actually do with a convincing email.
Evidence for audits
The report gives you dated, per-person results to show for Cyber Essentials, ISO 27001, insurers and client security questionnaires.
Train the right people
Anyone who clicks sees a short explanation straight away, so the lesson lands when it matters.
How the trial works
From signup to results usually takes a day or two, most of which is us checking your authorisation.
- Organisations only. You must sign up with your company email on your organisation's own domain, for example [email protected].
- Personal addresses such as Gmail, Outlook, Hotmail, Yahoo or iCloud will not work, and individuals or students cannot use Phishy.
- Simulations can only be sent to colleagues on that same company domain.
- One trial per organisation, and you must be authorised to arrange security testing.
Sign up
Use your work email and choose a password. It takes about a minute.
Authorise the test
Complete our short Authorisation to Test online. It confirms you are allowed to test your organisation.
We approve it
Usually within one working day. Your 14 days start from that moment, not before.
Launch and watch
Pick a template, add up to 10 staff and watch opens, clicks and password entries arrive live.
Trial or paid plan?
The trial shows you what Phishy does. A plan lets you test everyone, on every channel, every month.
| Free trial | Paid plans (from £99 a month) | |
|---|---|---|
| Staff per campaign | Up to 10 | 50 to 2,000 |
| Email phishing | Yes | Yes |
| SMS phishing | 3 tests | Included on Business and Pro |
| Voice call simulations | Not included | Included on Business and Pro |
| Clone your login page | Yes | Business and Pro |
| Email builder and AI-written emails | Not included | Business and Pro |
| Team members | Not included | 2 to 15 depending on plan |
| Results and PDF report | Yes | Yes |
| Length | 14 days, results kept 30 days after | Monthly or annual, cancel any time |
See every plan on the Phishy pricing section. Upgrade with the same email address and your trial account and results carry straight over.
Questions
Do I need a card to start?
No. The trial is free and we do not ask for payment details. You only pay if you choose a plan afterwards.
Can I sign up with Gmail or a personal email?
No. The trial is only for organisations testing their own staff. You need a company email on your organisation's own domain, and simulations can only go to colleagues on that domain. Gmail, Outlook, Hotmail, Yahoo, iCloud and other personal addresses will not work.
Why do you approve each trial?
Phishing simulations must only ever be sent with the organisation's permission. We check every Authorisation to Test before anything is sent. It usually takes less than one working day, and your 14 days only start once it is approved.
Will my staff know it is a test?
Not during the campaign, which is the point. Anyone who clicks sees a short awareness page explaining what happened and what to look out for next time.
Do you store the passwords staff type in?
No. Phishy records that a password was entered, never the password itself.
Will the emails reach inboxes?
Simulations are sent from authenticated domains. If you use Microsoft 365 or Google Workspace, the setup guide walks you through allowing them, which takes about five minutes.
What happens when the trial ends?
New simulations stop and your results stay available for 30 days. Choose a plan with the same email address to carry on where you left off. Nothing renews automatically.
See how your team holds up
Free for 14 days. Set up in minutes. Results you can act on.
Start my free 14-day trial