Phishing Simulation Services, Run by Practitioners, Not Platforms

Phishing simulation engagements at HackersHub are scoped per organisation, there is no fixed price list. Cost depends on workforce size, channels in scope (email, voice, SMS, OAuth), depth of pretext development, reporting requirements, and whether the engagement is one-shot or continuous. A scoping call typically takes 30 minutes and produces a fixed-scope written proposal within five working days.

For mature security programmes, continuous quarterly campaigns are the operational baseline, sustained pressure-testing exposes drift, while annual snapshots only validate a single moment in time. For organisations earlier in their programme, a deep one-shot campaign followed by a structured 90-day re-test is the right starting cadence. Cadence should match your threat exposure, not a generic calendar.

Yes, when properly scoped. Phishing simulation against your own workforce is legal under EU and Dutch law provided there is a documented legal basis (typically employer interest or consent), works-council notification where applicable under the Wet op de Ondernemingsraden, GDPR/AVG-compliant data handling, and a written rules-of-engagement agreement. We handle the legal scoping as part of every engagement, clients do not need their own legal team to draft the framework.

The right answer depends on your objective. If you are testing operational response, how quickly the SOC detects and contains an attack, employees should not be pre-warned, as this changes behaviour. If you are running an awareness intervention with measurable behavioural change as the goal, broad pre-notification of the programme (not specific campaigns) is appropriate. We help clients land the right position with works-council and HR during scoping.

Awareness platforms ship templates at scale, the model is high-volume, low-fidelity simulation against generic lures. HackersHub runs bespoke offensive engagements built from current threat-actor tradecraft, executed by senior practitioners, scoped per environment. Platforms answer: what percentage of our staff clicked a generic lure last month? We answer: would your finance team transfer money to a domain registered yesterday after a voice call from a deepfaked CFO? Different question, different methodology.

Phishing simulation tests human response to social-engineering attacks against a defined population. Red teaming is a goal-based adversary simulation, typically compromise this asset or exfiltrate this data within this window, which often uses phishing as one initial-access vector among many, alongside infrastructure attack, physical intrusion, and supply-chain pivots. When a phishing programme has matured to the point where a click-rate baseline is stable, the next step is usually goal-based red teaming.

Six to ten weeks. Week one to two: scoping, threat-intelligence work, legal and works-council alignment. Week three to four: pretext development, infrastructure build, internal sign-off. Week five to seven: campaign execution with staggered sends and multi-channel orchestration. Week eight to nine: analysis and reporting. Week ten: debrief workshop and remediation planning. Continuous programmes run on rolling quarterly cycles inside this same shape.

Click rate alone is misleading. We measure five dimensions: report rate (did anyone flag the lure?), report-time (how quickly?), credential-submission rate, dwell time before disengagement, and SOC detection latency. The interaction we care most about is reporting, a workforce that reports phishing within minutes is operationally stronger than a workforce with a low click rate that reports nothing.

Yes. Voice phishing (vishing) and SMS phishing (smishing) are in scope for any engagement where the rules of engagement permit. Multi-channel campaigns, where an email lure is followed up by a phone call from a number that matches the apparent sender, or where an SMS arrives ahead of an email to legitimise it, replicate current threat-actor tradecraft and are the most realistic simulation we run.

On request, yes. Some clients want their SOC blind to the engagement so we can measure unprompted detection. Others want the SOC informed at a senior level so the engagement doubles as a tabletop for their detection-and-response playbooks. Both shapes are valid; we agree the position during scoping.