The short version
- You can try it first with a 14-day pilot.
- Setup is four steps, and most of the follow-up is automatic.
- Your first phishing campaign sets a baseline, so don't expect perfect results.
Before you decide
Start by signing up. Create your organisation, pick a plan, and add your team. Questions along the way? Get in touch.
If you'd like to try it first, there's a 14-day pilot for up to 25 people on the Culture Builder plan, including one phishing campaign. We'll set it up the same week.
Getting set up
Once you've paid, your admin receives a secure setup link by email. It's valid for 7 days. From there:
- Create the admin account. Click the link and set a password.
- Add your company details. This sets up your organisation in the LMS.
- Choose how employees get access. Use Microsoft 365 or Google Workspace single sign-on, a verified company domain, or a CSV upload. Single sign-on comes with Culture Builder and Culture Leader.
- Assign courses and invite your team. Review your list of people, assign their courses and send the invitations.
Employees go straight to their training dashboard when they sign in.
Tell your team first
This step is yours, and it makes a real difference. Before invitations go out, let people know what's coming and why. Ideally, it comes from a senior leader.
Be clear that phishing simulations are there to help people practise, not to catch anyone out. People who trust the program are far more likely to take part and report what they see.
Your first phishing campaign
On Culture Builder and Culture Leader, phishing starts with a simple baseline campaign. It measures how each person handles the basics, so you know where your team stands.
Some people will click, and that's useful. It shows you where to focus.
After that, difficulty and content adjust to each person's role and how they responded last time. Finance teams might see invoice fraud, while engineering teams see fake repository invites.
What employees will notice
- Training that fits around work. Short videos built on real-life scenarios, with quick quizzes.
- Coaching, not scolding. If someone clicks a simulated phish, a one-minute walkthrough shows the warning signs they missed.
- Visible progress. Good catches earn a streak, so people can see themselves improving.
What admins will see
You get one dashboard for the whole program. It shows who has finished, how quizzes are going and who still needs to complete their training.
Automatic reminders do the chasing for you, on every plan. On Culture Builder and Culture Leader, you can also export audit-ready evidence when someone asks for it.
As the year goes on
Phishing exercises continue at regular intervals rather than once a year, and each one is tracked and reported back to you. Judge progress by the trend over time, not by any single campaign.
When you're ready, you can work towards CSWP certification to show the progress you've made.