Phishing Simulation & Awareness Training

68 Ready-to-Send Templates. Works in 30 Minutes. No Domain Purchase Needed.

Most phishing simulation platforms offer generic US-centric templates. SummitBridge runs 68 pre-built templates across 6 countries — 20 UK-specific (HMRC, Royal Mail, NatWest, NHS, Companies House), 19 Turkish (Trendyol, Garanti, PTT, Ziraat), 18 global (Microsoft, DocuSign, Adobe, Amazon), plus US, German and French variants. Our display-name spoofing engine makes emails appear from real brands — no domain purchase required.

• 68 Templates, 6 Countries: UK ×20 · TR ×19 · Global ×18 · US ×5 · DE ×4 · FR ×2 — all ready to send immediately
• Display-Name Spoofing Engine: Recipients see "HMRC Refund Service" or "Microsoft Security" — from your existing sending domain, no extra domains to buy
• M365 / Google / Mimecast / Proofpoint Bypass Configs: Pre-configured delivery settings for every major email gateway — no deliverability headaches
• Real-Time Click Tracking: Per-employee click data, open timing, device used, and link clicked — exportable instantly
• Auto-Enrolment Training: Employees who click are automatically enrolled in targeted awareness training — no manual intervention required
• Department-Level Vulnerability Map: See which teams click most — finance, HR, and senior leadership typically click 3× more than technical staff
• AI-Generated Templates: New attack scenarios generated weekly from live threat intelligence — always current, always realistic
• NIS2 Article 21(g) Evidence Pack: One-click export of campaign results, training completion rates, and improvement trends — audit-ready for regulators

⚠️ Legal disclaimer (COMPLIANCE): This product is provided for information and compliance documentation only; it is not regulatory advice. Read the full disclaimer below or in our Terms of Service before purchase.

NIS2 Article 23 Incident Reporting Awareness Module

Successful phishing is one of the most common triggers for a reportable NIS2 cyber incident. The training programme includes a dedicated awareness module covering Article 23 incident reporting obligations from the end-user perspective:

• What counts as a "significant incident" — plain-English explanation of NIS2 Article 23 reporting triggers tailored to non-technical staff
• The first hour after a click — what to do (and not do) in the first hour when a user realises they clicked a phishing link; preserves evidence for the 24-hour early warning window
• The 24-hour early warning — how user-side actions feed into the IT/security team's 24-hour early warning notification to the national CSIRT
• The 72-hour formal incident notification — how user testimony and timeline preservation support the 72-hour formal report
• Reporting without blame — psychological safety messaging so users report fast rather than hide

The module fits within the standard 30-minute awareness training session and is updated when national CSIRT reporting guidance changes.

Cyber Essentials 2026 Coverage (Awareness Tier)

Phishing is the most common path that bypasses every CE 2026 control. The simulation programme reinforces:

• User access control + MFA mandate — When MFA prompts unexpectedly: stop, don't approve; CE 2026 MFA-on-everything reduces credential-phishing impact; multi-factor enrollment retraining
• Secure configuration awareness — Why browser warning pages (TLS, blocked downloads) matter; how secure configuration baselines protect users from drive-by attacks
• Malware protection — Recognising EDR/antivirus alerts; never disabling endpoint protection even when prompted; reporting suspected malware infections
• Security update management — Why pending Windows / browser / app updates are urgent; how patch lag widens phishing impact
• Firewalls — Why VPN matters for remote workers; how network boundary controls back up endpoint defences