Phishmake @Phishmake

See how Phishmake runs realistic simulations from your own domain: phishmake.com

The 30 seconds after someone clicks a simulated phishing link matter more than the email itself. It's the most teachable moment you'll get all year. Most programs waste it. A good post-click page does five things: 1. Says plainly that it was a simulation. No blame, no drama. 2. Shows the exact email again, with the two or three clues they missed highlighted. 3. Teaches one habit, not ten. "Check the domain before you log in" is enough for today. 4. Takes under two minutes. 5. Tells them how to report the next one, in one line. A bad one does the opposite: → A flashing red warning → A 40-minute course they have to finish today → A line saying their manager has been informed The first builds a reflex. The second builds resentment, and people who hide their clicks next time. In Phishmake the landing page and the training page are both customisable, so they can sound like your company, not a vendor. Training is assigned automatically after a click, and completion is tracked per employee for your records.

See how Phishmake runs realistic simulations from your own domain: phishmake.com

Your security inbox is full of the best phishing training material you'll ever get. The emails your employees reported last month were written by real attackers, for your company. They already did the research. Use it. The workflow: 1. Pick a real phishing email someone reported. 2. Strip anything harmful. Keep the sender style, subject line, tone and pretext. 3. Paste it into Phishmake. It becomes a simulation template in seconds. 4. Next month, send it to the department it originally targeted. Why this beats generic templates: → It's relevant. Accounts gets the invoice lure that actually hit accounts. → It's current. It reflects what attackers are trying right now, not last year's library. → It's believable. Same brands, same vendors, same wording your people see. → It closes the loop. The person who reported it can help explain it in the debrief. And when you need a lure that looks like a tool we don't have a template for yet, your HRMS, your expense tool, your bank's portal, request it once and our team builds it for you. Included on every plan. The best training material is the attack that already targeted you.

CERT-In advisory CIAD-2026-0020, recommendations for individuals: cert-in.org.in/s2cMainServlet…

The voice on the phone sounds exactly like your MD. The number is unfamiliar. The request is urgent and "confidential". This isn't a thought experiment anymore. CERT-In now tells people to verify voice calls and video messages before acting on them. From CERT-In advisory CIAD-2026-0020: "Verify the authenticity of voice calls, video messages and urgent requests, particularly those involving financial transactions or sensitive information, as AI-generated deepfakes and impersonation attempts may be highly convincing." The same pattern runs through "digital arrest" calls, where someone posing as police or an investigator keeps a victim on a video call and demands money to "clear their name". Different channel. Same three-step reflex: 1. Pause. Urgency and secrecy are the attack. Any request that says "don't tell anyone" or "do it now" gets slowed down on purpose. 2. Verify on a channel you already trust. Hang up. Call back on the number saved in your phone or listed on the official website. Never the one that called you. 3. Report. Even if you didn't act on it. Someone else in your company probably got the same call. Two controls worth putting in place this month: → A callback rule for any payment or bank change request, no exceptions for seniority → A simple verification phrase for leadership and finance, agreed in person Phishmake simulations run over email. The reflex they build, stop and verify before you act, is exactly the one that beats a cloned voice.

See how Phishmake runs realistic simulations from your own domain: phishmake.com

The phishing email finance teams should worry about most has no link and no attachment. Just: "Our bank details have changed. Please update them before this month's payment run." This is business email compromise, and it slips past most of the usual defences. Why filters miss it: → There's no malicious link or file to scan → It may come from a real vendor mailbox that was compromised → Or from a lookalike domain registered last week, one letter off Why people comply: → It's a routine task they do every month → The name is familiar and the tone is right → There's a deadline, and a missed payment is their problem So the fix isn't "spot the fake". It's process: → Any change to bank details is confirmed by calling the vendor on a number you already have. Never the number in the email. → A second person approves any new or changed beneficiary. → First payment to changed details waits a day, and someone checks. → Anyone who gets this request reports it, even if they think it's genuine. Then test the process, not just the people. Send this exact scenario to your accounts team from a lookalike vendor domain and see what happens. Do they call? Do they report? Or do they reply asking for the cancelled cheque? Phishmake lets you build that scenario from your own vendor's email format, so the test looks like the real thing.

See how Phishmake runs realistic simulations from your own domain: phishmake.com

Your first phishing simulation is as much a communications exercise as a security one. Get it wrong and you lose your employees' trust for a year. Here's the sequence we'd follow. Before 1. Get written sign-off from the MD or CEO, and loop in HR. Nobody senior should hear about it from an angry employee. 2. Tell everyone a program exists, but not when. Something like: "Over the coming months we'll send realistic test emails. Nobody gets in trouble for clicking. Please report anything suspicious." 3. Ask your mail admin to allow-list the simulation so it actually lands in inboxes. 4. Pick a believable but harmless lure. A shared document or a courier update, yes. Fake bonuses, fake layoffs or health scares, no. During 5. Send in batches over a day or two, not all at once. Otherwise one person shouts "phishing!" across the office and your data is gone. 6. Brief the helpdesk so they know what's happening and what to say. After 7. Anyone who clicks sees a short, kind training page straight away, showing the clues they missed. 8. Share results within a week. Company and department numbers only, no names. 9. Thank the people who reported it. Publicly, if they're happy with that. 10. Book the next simulation before the debrief ends. The second one is where you see change. Do this once properly and the next ten get easier.

See how Phishmake runs realistic simulations from your own domain: phishmake.com

Attendance is not awareness. A signed register proves people were in the room. It says nothing about what they'll do at 6pm on a Friday with an "urgent" invoice in their inbox. Measure the behaviour, not the attendance.

See how Phishmake runs realistic simulations from your own domain: phishmake.com

Company-wide click rate is a comfortable number and a useless one. "12% clicked" doesn't tell you who to train, who to worry about, or who just had a bad Tuesday. What a security lead actually needs from a phishing program is a view per person, built up over several campaigns: → Who has clicked more than once → Who went further and entered credentials → Who reports suspicious emails consistently, and fast → Who was assigned training and hasn't completed it One click in six months is a bad day. Three clicks and a credential submission is a pattern, and that person needs a conversation and targeted training, not another company-wide session. On the other side, your fastest reporters are your early-warning system. Recognise them. Ask them to help brief their department. That's why Phishmake keeps a per-employee risk score that updates continuously as campaign results come in, next to the full journey for every employee: delivered, opened, clicked, attachment downloaded, credentials submitted, reported, training assigned, training completed. Results stay visible only to the admins in your workspace. This is for targeting help, not for naming and shaming.

Our founder expected cybersecurity conversations at @bsidesahmedabad. A push-up challenge on stage? That was a surprise 😄 @Rj_kunal from Mirchi Murga FM challenged him and our founder took it on, completing a plank push-up on stage. Thanks to @Rj_kunal for bringing the energy and giving us a moment we’ll remember long after the event. @Phishmake team: challenge accepted! #BSidesAhmedabad #Phishmake

See how Phishmake runs realistic simulations from your own domain: phishmake.com

If you're a SEBI-regulated entity, your CSCRF audit will look at awareness and training. The easy answer is an attendance sheet. That proves the session happened. It doesn't prove it worked. Awareness and Training sits under the Protect function of SEBI's Cybersecurity and Cyber Resilience Framework (PR.AT). For brokers, depository participants, portfolio managers and RTAs, that means an auditor will ask what you did, who it covered and how you know. Here's the evidence pack we'd build. Two halves. Proves it happened: → Training calendar and session dates → Attendance, by role → Material used, updated for this year's threats Proves it worked: → Simulation results per employee → Who reported the test email, not just who clicked → Training assigned after a click, and completed → The trend from one quarter to the next One more thing auditors notice: role-specific risk. Dealers, back office, accounts and privileged IT users get different attacks. A dealer sees fake exchange or client messages. Accounts sees invoices and bank detail changes. Train and test for the inbox each team actually has, and group results the same way. The first half is the easy part. The second half is what makes the file credible.

Thanks to everyone who stopped by the Phishmake booth at @bsidesahmedabad 2026. We loved meeting the community and talking about phishing simulations and security awareness. #BSidesAhmedabad #phishmake

@cyber_razz Good humor! But you missed the important part: how security awareness training is conducted, what topics are covered, and how the training is delivered. That’s what really matters.

RBI (Non-Banking Financial Companies - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras 35-36: rbi.org.in/Scripts/BS_Vie… Phishmake tracks every employee from delivery to training completion: phishmake.com

One sentence in RBI's 2026 cyber directions for NBFCs changes what "we did the training" means: "The NBFC shall deploy a formal mechanism to measure and track the effectiveness of such training through periodic assessments or testing." That's para 36. Para 35, just before it, asks for a robust, ongoing information security training and awareness programme for all users, reviewed as threats change. Para 36 continues: maintain an up-to-date repository of the training and awareness status of all users. So three requirements: 1. Ongoing, for all users. Not a one-time induction. 2. Measured. Attendance shows who sat through a session. It doesn't show whether it worked. 3. Recorded per user. A repository, kept up to date. Who this applies to matters, so read carefully. These two paragraphs sit in Chapter IV, which covers Base Layer NBFCs with assets of ₹500 crore and above. Smaller Base Layer NBFCs fall under Chapter III, which doesn't have this clause. For Middle and Upper Layer NBFCs, the hooks are elsewhere: the Information Security Committee approves and monitors security awareness initiatives (para 77), and senior management builds a culture of cyber hygiene (para 74). A periodic phishing simulation is one practical way to do the "testing" part. It produces a result per person, not per session, and it shows whether that result moves. What "track the effectiveness" could look like in a file: → Baseline simulation result, per user → Training assigned to those who clicked, with completion date → Follow-up simulation result → Quarter-on-quarter trend for the committee Check which chapter applies to you before anyone tells you something is mandatory. Link to the direction in the reply.