Managed phishing testing
Run realistic phishing simulations and short follow-up training that help employees pause before they click.
From $395 for up to 10 participants. Standard setup included. No Security Baseline required.
What SYB handles
We set up and administer the phishing campaign, coordinate the scenarios, and provide a short follow-up training assignment so the business can review what happened without managing another platform.
Setup may require assistance or limited authorized access from the email administrator. We do not promise a no-access setup, and we do not collect or retain actual passwords.
Who this is for
This is designed for businesses that need someone to run the process, without building a security program from scratch.
Realistic business scenarios
These are emails designed to test judgment in common business workflows. They are not an assessment of real customer incidents.
A realistic message can test whether employees pause to verify a request before they click or reply.
This type of business scenario is common in accounting, operations, and procurement workflows.
Organizations often need to confirm whether staff recognize suspicious requests that appear to come from a familiar internal process.
For trucking and logistics teams, email scenarios often mimic carrier, driver, or dispatch correspondence.
Phone calls, in-person impersonation, and highly customized executive scenarios are outside the standard email campaign and require separate scoping.
Pricing
Participants are individual people enrolled in the campaign, not total company headcount. Shared mailboxes, contractors, and employees without individual work email accounts are addressed during scoping.
| Participants | One-time campaign | Annual program |
|---|---|---|
| 1–10 | $395 | $995/year |
| 11–25 | $595 | $1,495/year |
| 26–50 | $895 | $2,495/year |
| More than 50 | Scoped quote | Scoped quote |
What the business receives
The service is designed to answer what happened, which staff engaged with the scenario, and what needs attention next.
Simulation difficulty and automated email-security activity affect interpretation. A click rate is not proof of overall business security.
Insurance documentation
“If your insurer has requested phishing testing or security awareness training, share the exact wording with us. We will scope the engagement around the stated requirement and provide dated records of the work completed. Your insurer or broker confirms whether those records satisfy its requirements.”
Distinguish testing, training, frequency, participant coverage, and completion evidence. We do not promise insurance approval, renewal, coverage, claim payment, or premium reductions.
How it works
We confirm the purpose, the participants, and the business context for the campaign.
We confirm the email environment, any required access, and final campaign timing.
We deliver the simulation, track engagement, and assign concise follow-up training.
Leadership receives a short readout, campaign results, and supporting records as published.
FAQs
The launch pricing is $395 for up to 10 participants in a one-time campaign, $595 for 11–25 participants, and $895 for 26–50 participants. Annual programs are priced at $995, $1,495, and $2,495 respectively. Larger programs receive a scoped quote.
Yes. One-time campaigns include one selected email scenario, standard setup, short follow-up training, a dated report, and a short manager readout.
No. Managed phishing testing is a standalone service. It is available without the Security Baseline and can be scoped independently for your business.
Yes. We can coordinate with your MSP or provider when an authorized email environment or support contact is needed for setup.
Yes. The campaign can be scoped to the enrolled participants in a given test, but the participants are still counted individually. Testing only some employees does not establish whole-workforce training completion.
Shared mailboxes, contractors, and people without individual work email accounts are addressed during scoping. The campaign scope should reflect the specific participants in the test.
If your insurer has requested phishing testing or security awareness training, share the exact wording with us. We can scope the engagement around the stated requirement and provide dated records of the work completed. Your insurer or broker confirms whether those records satisfy its requirements.
No. Actual passwords are not collected or retained as part of the campaign. We focus on the business interaction and the training follow-up, not credential capture.
The standard annual program includes four campaigns over 12 months, with four short training assignments and completion reminders. Quarterly campaigns are the standard annual schedule.
Phone calls, in-person impersonation, and highly customized executive scenarios are outside the standard email campaign and require separate scoping.