Free phishing test

It is a free phishing quiz: twelve scenarios in three levels, half phishing and half genuine. For each one you choose what you would do: report it, delete it, or act on it. You see the red flags straight after, and a certificate at the end. Difficulty levels were set with the NIST Phish Scale as a reference.

The phishing quiz tests what you know and what you would do: you judge twelve scenarios on this page, choose to report, delete or act, and see the red flags after each answer. The free phishing test for employees shows what your employees actually do: Keepnet sends realistic phishing simulations to them by email, SMS, call and QR code, and the report shows who acted on each one and who reported it.

Yes. Twelve scenarios, about five minutes, no sign-up to take it, an explanation and a red-flag breakdown after every answer. The certificate at the end asks only for your name.

Request it with the form on this page. A 30-minute call confirms eligibility and the channels you want covered. Your employees then receive multi-channel phishing simulations, not email-only, and you get a report per channel: who acted on it and who reported it. Subject to eligibility, terms apply.

Yes, as part of the free test for your organisation. Email is one channel; the same test can include SMS, call and QR code, because an email-only test leaves out the messages that reach employees on their phones.

It works like one, with two differences: it covers more than email, and it scores what you would do, reporting included, not only whether you spot the phishing.

Yes. The free test runs alongside your current programme, so you can see how your employees respond on channels you may not test today, such as SMS and call.

A test that is mostly phishing rewards calling everything phishing. This one scores two things separately: how much phishing you catch, and how many genuine messages you trust.

In email it works the way Keepnet Phishing Reporter does in Outlook: it asks why you are reporting the email, sends it for analysis, and the result comes back to you by email. For SMS and calls, the Keepnet SMS and Call Reporter app reports them from Messages or the Recents list and returns a verdict in seconds.

Email, SMS, call, QR code, MFA push notification, WhatsApp, Slack, callback phishing and deepfake video. Phishing is no longer an email-only problem, so an email-only test measures the wrong thing.

Scenarios with a sender, a link or a company name are rebuilt around your own domain: the fake sign-in email arrives from a lookalike of your domain, the legitimate messages come from your real one, and the prompts carry your company name. Your details stay in your browser and are not sent to Keepnet. You can skip it and take the generic test instead.

The quiz does not send or keep it. If you personalise the scenarios, its domain puts your company into them, in your browser only. Full detail is in the Privacy Notice.

Yes. After the twelfth scenario you get a certificate of completion with your score, your name and a certificate ID. It appears on the page with your name on it, ready to print, save as a PDF or add to your LinkedIn profile. It is a self-assessment record, not a professional qualification.