EyeOnPhish is an automated phishing simulation and security awareness training platform built in India. It sends employees safe, realistic simulated phishing attacks, trains anyone who clicks at the moment they click, and produces compliance-ready evidence for audits.

What is a phishing simulation?

A phishing simulation is a harmless fake phishing attack sent to your own employees to measure who would fall for a real one. Nothing is harmed and no passwords are captured. The organisation learns which employees clicked, who reported the message, and where awareness training is needed.

Which channels can EyeOnPhish test, other than email?

EyeOnPhish runs simulations across email, SMS, voice calls including AI-cloned voice scenarios, and QR codes, all within one program. This matters because QR and SMS attacks reach employees on personal phones, outside the corporate mail gateway.

Which compliance frameworks does EyeOnPhish support?

Campaign and training records map to ISO/IEC 27001:2022 control A.6.3, PCI DSS 4.0 requirement 12.6.3, NIST CSF 2.0 PR.AT-01, SOC 2 criteria CC1.4 and CC2.2, the HIPAA Security Rule at 164.308(a)(5), and the reasonable security safeguards expected under the India DPDP Act 2023.

Does EyeOnPhish capture employee passwords?

No. Credential harvesting simulations record only the fact that a password was typed. The password itself is never captured or stored.

What is a phish-prone rate?

Phish-prone rate is the share of tested employees who take the bait in a simulation. It is the single metric most organisations report to their board, tracked monthly and broken down by department.

Does EyeOnPhish require software to be installed?

No agent installation is required. EyeOnPhish is browser-based and connects to Microsoft 365 or Google Workspace to sync users and run campaigns on your own domain.

How much time does running a program take?

Campaigns are configured once, then schedule themselves, send, and enrol clickers into training automatically. No security analyst needs to manage the program day to day.

Turning human error into human defence.

EyeOnPhish is an automated phishing simulation and awareness training platform, built in India, that brings both into one place. It's built to meet the compliance and client due-diligence requirements every organisation is now expected to satisfy.

Book your demo See how it works

See it running on your own domain. No agent to install.

Inbox — Priya Nair

Action required: your password expires in 12 hours

Microsoft 365 Support no-reply@micros0ft-secure.com

Hello Priya,

Our records show your work password will expire today. To avoid losing access to email and files, confirm your credentials now.

This is an automated message. Do not forward to IT.

31%Average employees who click on a first, untrained simulation

10%Typical click rate after twelve months on a monthly program

90 secLength of the lesson a clicker sees, in the moment they click

1 clickTo export the awareness evidence pack for an audit

A campaign runs in four moves

Set it up once, then let it repeat monthly. No security analyst needs to manage it day to day.

Step 1

Sync your people

Pull users and groups from Entra ID, Google Workspace or a CSV. Departments and managers come across, so results can be sliced the way your business is organised.

Step 2

Pick the lure

Use one of our templates as it is, clone and tweak one to fit your business, or build your own from scratch in the HTML editor. Send in batches over days so the office grapevine does not warn everyone.

Step 3

Watch what people do

Opens, clicks, credentials entered, attachments run and reports raised, all tracked per user.

Step 4

Train and repeat

Anyone who clicks is automatically mandated into a short awareness module and has to complete it. Use one of our ready-made modules or add your own content to it. Next month's campaign gets harder for them and lighter for everyone who reported.

One employee clicks, and attackers are in

Attackers get in through employees, not servers. One employee who wasn't paying attention is enough. EyeOnPhish trains that out - safely, and before a real attacker tries.

The problem organisations face

Employees don't recognise a fake

Most employees have never seen a phishing email explained. They see a normal-looking message, they click, and that one moment is all an attacker needs to get in.

What EyeOnPhish resolves

Three moves that close the gap

The test

We send safe fake attacks

Realistic phishing emails, SMS and QR codes go out monthly. Nothing is harmed. You simply see who clicks.

The training

Clickers learn straight away

Anyone who falls for it gets a short lesson on the spot, showing the clues they missed. Three to five minutes, not a yearly slideshow.

The result

Awareness goes up, risk goes down

Clicks typically drop from 3 in 10 employees to under 1 in 20 within a year. Your people become the layer that stops the attack.

Lures that match what is actually landing

Over 200 templates across email, SMS, voice and QR, localised into other languages on request, with sender domains you can register through us or bring yourself.

Credential harvesting

Lookalike Microsoft, Google and VPN sign-in pages that capture the fact a password was typed, never the password itself.

Starter

Invoice and payment fraud

Supplier bank-detail changes aimed at finance, the pattern behind most business email compromise losses.

Targeted

QR code phishing

A code in an email or a printed poster, so the click lands on a personal phone outside your mail gateway.

Advanced

MFA fatigue and OTP theft

Repeated push prompts followed by a call from "IT" asking the user to read out the code.

Advanced

Attachment and macro lures

Harmless files that record whether they were opened and whether content was enabled.

Starter

SMS and callback pretexts

Delivery notices and helpdesk numbers, for testing employees who work mostly from a handset.

Targeted

Voice phishing and deepfake calls

AI-cloned voices of a CFO or IT lead, asking for a payment override or a password reset over the phone.

Advanced

Fake collaboration invites

Spoofed SharePoint, Google Drive and Teams shares that lead to a lookalike sign-in page.

Targeted

What changes when testing keeps up with attackers

Most phishing programs still run like it's 2015: one template, one channel, once a month. Here is the difference an adaptive program makes.

Fixed monthly blast

Same generic template sent to everyone
Same difficulty, every single month
Email only
Training happens once a year, if at all
An analyst schedules and reviews every send
Click rates live in a spreadsheet nobody opens

Adaptive program

Lure built from real attacks and the person's role
Difficulty rises or eases based on the last result
Email, SMS, voice and QR in one program
Teachable moment appears the second someone clicks
Runs on autopilot once it is configured
Board-ready evidence pack, one export

Learning happens right where the mistake did

A yearly slide deck is forgotten before lunch. EyeOnPhish corrects the moment it happens: the person who clicked sees exactly what gave it away, then works through one short lesson built around it.

Corrects in the moment. The landing page highlights every clue hiding in the exact email that fooled them.
Nothing to chase. Clickers are enrolled in training automatically, reporters get a thank-you, and nobody tracks it in a spreadsheet.
Built to actually finish. Three to five minutes, mobile-first, closing with a two-question check.
Matched to the job. Finance sees payment-fraud scenarios, engineers see credential and token theft.
Never a name-and-shame list. Manager views roll up by team, not by person, so the program stays about learning.

Spotting a fake senderDomain lookalikes and display name tricks

4 min

Payment change requestsVerifying supplier bank details

5 min

When your phone buzzes twiceMFA prompts you did not start

3 min

Scanning codes safelyQR lures on email, posters and invoices

3 min

Reporting without hesitatingUsing the report button, and what happens next

4 min

Evidence your auditor accepts

Most frameworks ask for the same thing in different words: prove employees were trained, prove it repeats, prove it works. Every campaign and module maps to the control it satisfies, and we hand you a professional report and evidence pack your compliance team can accept as-is.

Framework	Control	What EyeOnPhish produces
ISO/IEC 27001:2022	A.6.3 awareness, education and training	Dated attendance and completion records per employee, with campaign history
PCI DSS 4.0	12.6.3 security awareness, including phishing	Annual plus incremental training logs and simulation results covering in-scope employees
NIST CSF 2.0	PR.AT-01 personnel awareness	Trend of phish-prone rate by department against your baseline
SOC 2	CC1.4 and CC2.2 competence and communication	Exportable evidence pack for the observation period
HIPAA Security Rule	164.308(a)(5) awareness and training	Per-user records including reminders and repeat offenders
India DPDP Act 2023	Reasonable security safeguards	Program documentation with data kept in an Indian region

One number your board will follow

Phish-prone rate is the share of tested employees who took the bait. Track it monthly, by department, and the argument for the program makes itself.

Phish-prone rate, first year of a monthly program

An illustrative curve. Once you onboard, this is your dashboard, tracking your own tenant month by month.

See it running on your organisation

Book your demo and we will show a live campaign, the training flow and the reporting your auditor will want to see, tailored to your organisation.

Thanks. Your demo request is in, and we will confirm a time by email.