Phishing Simulation & AwarenessExposure & Validation

Test your people like attackers do. Train them at the click.

Netgraph's phishing simulation sends real lures over your own SMTP to cohorts drawn straight from the Asset Register — or to a plain email address for a five-minute pilot — then tracks opens, clicks and credential submissions, delivers training at the exact moment of the mistake, and feeds every outcome back into UEBA risk and the KPI report generator. The same platform triages the phish your users report.

Real send, your SMTPCohorts from Asset RegisterJust-in-time trainingRepeat-clicker trackingNative Phish-Triage agent

Book a demo →Why Netgraph →

What ships in the module

The full campaign lifecycle — outbound and inbound.

Campaign builder

Templates, scheduling and cohort targeting in one flow. Pick a lure template, set the send window, choose who receives it — campaigns are defined once and run on schedule.

Cohort & direct targeting

Target identity cohorts drawn from the Asset Register — or type email addresses directly for a quick pilot with no identity import needed. Start testing in minutes, scale to the whole org later.

Real send — honestly

Lures deliver over the tenant's configured SMTP. When SMTP or recipients are absent, the campaign falls back to simulate mode with a specific stated reason — never a silent fake success.

Landing & tracking

Landing pages record opens, clicks and credential submissions (simulated capture — no real credentials are stored) so you see exactly how far each user went down the funnel.

Just-in-time training

The teachable moment is the click. Users who take the bait get a training moment at the point of click — not a quarterly video assignment three weeks later.

Program KPIs

Campaign funnel metrics, repeat-clicker tracking and program trends over time — the numbers that show whether awareness is actually improving, ready for the KPI report generator.

Phish-Triage agent

The inbound side is native: user-reported phish is triaged automatically by the Phish-Triage agent with graph context — reporters get answers, analysts get verdicts, not a shared mailbox backlog.

UEBA feedback loop

Campaign outcomes feed UEBA as risky-user signals — a repeat clicker's behavioural risk reflects it, and the rest of the platform sees the same user through that lens.

Scheduled programs

Campaigns run on schedule as an ongoing program, not a one-off exercise — trends accumulate release over release so leadership sees direction, not snapshots.

From template to trend line

Define the campaign once. Read the funnel forever.

A campaign is a template, a cohort, a schedule and an SMTP path. Netgraph delivers it for real, tracks every stage of the funnel, and turns the results into signals the rest of the platform acts on — UEBA risk for the users who clicked, KPI trends for the program owner.

Cohorts come from Asset Register identities — or paste addresses for a no-setup pilot.
Delivery is real when SMTP is configured; simulate fallback always states its reason.
Click → training moment, immediately — the lesson lands while it still stings.
Outcomes flow to UEBA risky-user signals and the KPI report generator automatically.

Functionality map

Module functions at a glance

Function	What it does	Where it lives
Campaign builder	Templates, scheduling, cohort or direct email targeting	Phishing Simulation ▸ Campaigns
Delivery	Real send over tenant SMTP; simulate fallback with a specific stated reason	Phishing Simulation ▸ Campaigns
Landing & tracking	Opens, clicks, simulated credential-submission capture per recipient	Phishing Simulation ▸ Results
Just-in-time training	Training moment served at the point of click	Landing page flow
Program KPIs	Funnel metrics, repeat-clicker tracking, program trends	Phishing Simulation ▸ Results; KPI Report Generator
Phish-Triage agent	Automatic triage of user-reported phish with graph context	Agentic SOC ▸ Phish Triage
UEBA feedback	Campaign outcomes become risky-user signals in behavioural risk	UEBA risk factors

See it live

Send yourself the first lure. Then send it to the org.

Book a demo →Browse all modules