Stop the Breach Before It Starts.
Your employees are your first line of defense—or your greatest vulnerability. We simulate real-world attacks to train your human firewall and provide the metrics you need to prove your organization is secure.
Dear User,
Our records show your mailbox credentials were not validated during this month's security review. Accounts that remain unvalidated for more than 2 hours are suspended automatically and must be restored by the service desk.
Verify your account at the Meridian Employee Portal3
link resolves to: meridian-verify.account-check.net/login
Please confirm your current password on the page above so access can be extended.4
IT Service Desk
- 1Lookalike sender domain. The display name is internal, the domain is not. A hyphen and an extra word are all it takes.
- 2Manufactured urgency. A deadline measured in hours exists to stop the reader from checking with anyone.
- 3Mismatched link. The text names an internal portal. The destination the link resolves to does not match it.
- 4Credential request by email. No internal process asks staff to re-enter a password from a message they did not request.
Campaign lifecycle
A single annual test measures nothing durable. The program is a loop, and each pass through it is designed to move the trend line.
Baseline
A diagnostic first campaign, run before any training is assigned.
Simulate
Recurring campaigns with rotating lures, difficulty, and targeting.
Measure
Click, report, and timing behavior captured per person and department.
Train
Remediation delivered at the moment of the click, not next quarter.
Repeat
The cadence continues, so the trend line is the deliverable.
The metrics we report, and what each one proves
Below is the reporting surface of the program, not a set of results. Values are produced by your campaigns, so this panel shows the measures and what they demonstrate.
The share of recipients who engaged with the lure. Your raw exposure.
The share who reported it. The behavior you are actually trying to build.
How quickly the first report reaches your team. Dwell time before response.
Individuals caught across multiple campaigns. Where escalation is warranted.
Which functions carry the concentrated risk, rather than one blended figure.
Direction across campaigns. Whether exposure is shrinking or holding.
# no figures shown: this panel documents reporting capability, not results
What's included
Targeted & Spear-Phishing Scenarios
Executives, finance staff, and system administrators are attacked differently from everyone else. We build targeted scenarios around business email compromise, wire fraud pretexts, and vendor impersonation aimed at the roles adversaries actually research.
AI-Generated Phishing
Generative models removed the broken grammar that used to give phishing away. Our campaigns include AI-crafted lures so your people are tested against the quality of message they will actually receive.
Try the AI Threat Spotter lab →Just-in-Time Remediation Training
The moment someone clicks is the moment they are most receptive. Clicking a simulation delivers immediate, short training tied to the exact lure that caught them, with escalating curriculum for repeat clickers.
Audit-Ready Compliance Evidence
DIR, CMMC, and HIPAA all expect documented security-awareness training. We produce the participation records, completion tracking, and campaign history auditors ask for, organized before the request arrives.
Program Design & Cadence
Campaign frequency, lure difficulty, and departmental targeting are set deliberately rather than left to a template. We tune the schedule so the program keeps producing signal instead of becoming background noise.
Phishing simulation questions.
- What is a phishing simulation?
- A controlled exercise in which realistic but harmless phishing messages are sent to your own staff to see how they respond. Nothing is compromised. The point is to find out how your organization behaves under a real lure, and to train at the moment someone clicks, which is when the lesson lands.
- How does a campaign run from start to finish?
- Five stages: establish a baseline, run the simulation, measure the response, deliver training to the people who need it, and repeat. A single simulation produces a number. Repetition is what produces a trend, and the trend is the part worth reporting.
- What gets measured?
- Click rate, report rate, time to report, repeat clickers, department breakdown, and the trend across campaigns. Report rate and time to report matter more than click rate over time: an organization where people click but report quickly is in better shape than one where nobody clicks and nobody says anything.
- Are employees punished for clicking?
- No. The purpose is training, not discipline. People who click receive targeted training at that moment. A program that punishes clicks mainly teaches staff to hide them, which removes the reporting signal that makes the whole exercise useful.
- Do you use AI-generated phishing lures?
- Yes, alongside conventional and spear-phishing scenarios. Attackers use the same tooling, so simulations that only use obvious templates train people against a threat that has already moved on.
- Can we use the results as compliance evidence?
- Yes. Campaigns produce audit-ready records of who was tested, what they received, how they responded, and what training followed, which is the documentation most security awareness training requirements ask for.