Phishing Simulation To Test Staff Awareness
Budget: ₹600 – ₹1,500 INR
My 20-person team handles customer information daily, and I want a clear, data-driven picture of how well they spot phishing attempts. The job is to run one complete, intermediate-level phishing simulation—from creating the email scenarios to delivering a concise results report.
Scope
• Design several moderately convincing phishing emails (no generic copy-paste templates).
• Send the campaign to all 20 staff members using a platform such as GoPhish, KnowBe4, or a comparable tool you already trust.
• Track opens, clicks, submitted credentials, and any email replies.
• Ensure messages are safely sandboxed so no real systems or data are put at risk.
• Keep the exercise entirely covert until the campaign ends; I will brief the team afterward.
Deliverables
1. Campaign setup files (email copy, headers, landing pages if used).
2. Raw metrics export (CSV or similar).
3. Executive summary highlighting: overall click-through rate, high-risk behaviors observed, and quick-win recommendations.
Acceptance Criteria
• At least two distinct phishing scenarios delivered.
• Reporting accuracy within ±5 % of platform logs.
• All activities remain fully compliant with local law and our internal IT policies.
Timeline is flexible within two weeks of project start, and I will supply the sending domain and any required SPF/DKIM access once we agree on an approach.
Scope
• Design several moderately convincing phishing emails (no generic copy-paste templates).
• Send the campaign to all 20 staff members using a platform such as GoPhish, KnowBe4, or a comparable tool you already trust.
• Track opens, clicks, submitted credentials, and any email replies.
• Ensure messages are safely sandboxed so no real systems or data are put at risk.
• Keep the exercise entirely covert until the campaign ends; I will brief the team afterward.
Deliverables
1. Campaign setup files (email copy, headers, landing pages if used).
2. Raw metrics export (CSV or similar).
3. Executive summary highlighting: overall click-through rate, high-risk behaviors observed, and quick-win recommendations.
Acceptance Criteria
• At least two distinct phishing scenarios delivered.
• Reporting accuracy within ±5 % of platform logs.
• All activities remain fully compliant with local law and our internal IT policies.
Timeline is flexible within two weeks of project start, and I will supply the sending domain and any required SPF/DKIM access once we agree on an approach.