Most successful cyberattacks do not begin with a breach of a firewall, but with a single email that someone has clicked on. A phishing simulation shows what could happen in your organisation before it actually happens.
CONSEJO conducts controlled phishing campaigns that resemble real attacks but do not cause harm. After the campaign, you receive a clear report showing how many employees opened the message, how many clicked, how many entered data and how many reported the message. The report also indicates what needs to be done to reduce the risk.

Why Conduct a Phishing Simulation?

• Measurable risk instead of assumptions. You see how employees actually behave, rather than simply whether they have attended training.
• Targeted training. You focus your efforts on the departments and individuals who need it.
• Evidence of compliance. The report serves as evidence of awareness measures during an inspection or audit.
• A culture of reporting. Employees learn not only to avoid clicking but also to report suspicious messages promptly.

Compliance with Requirements

• Bulgarian Cybersecurity Act and NIS2: The Directive requires basic cyber hygiene practices and cybersecurity training (Article 21), as well as training for management (Article 20).
• ISO/IEC 27001: Control A.6.3 requires information security awareness, education and training.
• DORA: Financial organisations must conduct digital operational resilience awareness and training programmes for their employees.

How It Works

1. Scope and rules. We agree on which employees will participate, which scenarios are permitted and who within the organisation will be informed.
2. Scenarios. We prepare realistic messages tailored to your industry and the attacks currently occurring in Bulgaria: fake courier notifications, invoices, banks, Microsoft 365 password requests and others.
3. Campaign. We send the messages in stages to prevent employees from warning one another.
4. Report and recommendations. You receive results by department and specific measures to be implemented over the following months.
5. Training. Practical training on recognising phishing emails.
6. Repetition. We recommend conducting campaigns every 3 to 6 months to monitor progress.

What You Receive

• A report with the results: opened messages, clicks, entered data and reported messages
• Comparisons between departments and, for repeated campaigns, over time
• Recommendations for technical and organisational measures
• Brief training materials for employees
• A management summary suitable for reporting under the Bulgarian Cybersecurity Act or for a management review under ISO/IEC 27001.

Personal Data and Ethics
The simulation is conducted according to previously agreed rules and with the involvement of management. The results can be presented in an aggregated form without identifying individual employees. The aim is not to find someone to blame, but to reduce the risk to the organisation.

Frequently Asked Questions
Do employees need to know in advance?
Not about the specific campaign, as this would make the results unrealistic. However, we recommend that employees be informed that the organisation conducts periodic awareness assessments.
How long does it take?
Preparation takes approximately 1 to 2 weeks, while the campaign itself usually lasts 1 to 2 weeks.
Is it suitable for small organisations?
Yes. The smaller the organisation, the greater the impact of a single successful phishing email.
Can it be combined with other services?
Yes. Phishing simulations are often conducted together with penetration testing or as part of preparations for compliance with NIS2 and the Bulgarian Cybersecurity Act.
 
 

Phishing Simulations for Employees