A multi-channel phishing simulator that builds secure behaviour.

Run well, they move the behaviour that protects an organisation, which is reporting. Across Keepnet customers: Nautilus International saw 75% fewer clicks on malicious links, and up to 97% faster employee reporting. Wisebits went from a 25% phishing test failure rate to 3 to 4%, and it held as the scenarios got harder. Teknosa took recognition of voice phishing from 45% to 80% in 90 days, across 2,500 staff in 211 stores.

Two things decide whether you see that. Difficulty, because an easy scenario flatters the numbers. And channel: in the 2026 Verizon Data Breach Investigations Report, phone-based simulations failed roughly 40% more often than email ones, so a programme that tests only email is measuring the channel employees already handle best. Keepnet contributed the voice and SMS simulation data to that report.

Measure reporting rate and time to report across months. A completion rate tells you the training was opened, not that anything changed. The UK National Cyber Security Centre makes the same case for reporting: “Building a culture where users can report phishing emails (including where they’ve been clicked-on) gives you vital information about what types of phishing attacks are being used.”

Customer results as those customers published them. Simulation comparison: Verizon 2026 Data Breach Investigations Report, p. 50. Keepnet is named in its contributors list, p. 118. NCSC, Phishing attacks: defending your organisation.

Email, voice, SMS, QR, callback, MFA and deepfake. The same simulated phishing scenario can go out on more than one of them, in the language each employee works in.

The results land in one reading rather than one report per tool, so a click rate on email and a click rate on SMS sit side by side.

Yasar Geren, Director and Extended Executive Committee Member at AXA Insurance: “We were seeing more voice and SMS phishing targeting executives, finance teams and IT helpdesks. Keepnet gave us a way to simulate those attacks, train the people being targeted and give employees a simple way to report suspicious SMS and calls when they happen for real.”

Microsoft Attack Simulation Training simulates email and QR, and it comes with Defender for Office 365 Plan 2 rather than being sold on its own. If your programme is email-only and you already hold that licence, it covers the basics. On email its reporting is deep: predicted and actual compromise rate, repeat offenders, and first and average time to click.

Where teams move is channel. It does not place voice calls or send SMS, and it does not report on what employees do with those. In the 2026 Verizon Data Breach Investigations Report, phone-based simulations failed roughly 40% more often than email ones, so an email-only programme leaves the weaker channel untested.

The longer comparison, with the sources.

Channels, reporting on a real SMS or a real call, how you buy it and published price are where the vendors actually differ. Each comparison is published in full, with the reasoning and the source behind every line: KnowBe4, Microsoft Attack Simulation Training, MetaCompliance, Proofpoint, Hoxhunt, Adaptive Security.

A vendor’s own comparison is a starting point rather than the verdict. Keepnet Labs has a rating of 4.9 out of 5 based on 104 ratings in the Security Awareness Computer-Based Training market on Gartner Peer Insights as of October 2026, and 5.0 out of 5 based on 46 reviews on Capterra as of October 2026. The other vendors in this market are listed on both sites, so the comparison can be checked without us.

Keepnet’s. We buy the numbers and complete the compliance steps for each country we offer them in, so you do not need a telephony account, a carrier relationship or a sender ID registration of your own. The numbers are bought for this purpose and used only for Keepnet simulations.

Caller ID is not spoofed. Spoofing breaches telecoms rules in several countries, so simulations run from A2P 10DLC compliant numbers instead.

Use the library as it is, edit any template, or create your own, landing page included. Selection can be role-based, so the scenario an employee receives fits the work they do. Red flags are produced for every template in the library, in that template’s own language.

Difficulty is set by the NIST Phish Scale, and it is held across localisations automatically, so click rates stay comparable across a border.

You decide how much runs without you. The agents draft and schedule, and every step can sit behind an approval gate, from full review of each campaign through to autopilot once you trust it.

Generated content is checked before it goes out, and simulations are produced inside a global framework and your own organisation’s policy. Deepfake is opt-in, and who appears in one is approved before it runs.

Frequency is capped per employee, and sending follows either your schedule or the employee’s behaviour, so a programme cannot turn into a daily stream. See what the agents do.

Nothing is recorded against a name. A click, a scanned QR, an opened attachment or submitted data opens a coaching page at that moment, on the template the employee just engaged with. An answered call is coached inside the call.

You can send the training when the campaign ends instead. See what happens after the click.

The UK National Cyber Security Centre gives the same instruction: “Don’t reprimand users who are struggling to recognise phishing emails.” and “Avoid creating a punishment or blame-oriented culture around phishing.”

NCSC, Phishing attacks: defending your organisation.

By comparing the same employees before and after, not by counting who finished a module. Completion, click rate and reporting rate are all in the platform, and the reading that decides the question is whether the behaviour moved.

Reporting rate and time to report are tracked campaign after campaign, across channels, including SMS and calls. Both are counts, so neither hides what it is made of.

Risky and positive behaviours are recorded per employee, each carrying a severity, so susceptibility is visible at employee and department level rather than as one number for the organisation.

Repeat risky behaviour is tracked alongside them, and the reading sits against the target you set and your sector. The behaviour score is those same recorded behaviours added up, each keeping its severity, its date and the framework control it maps to, so the score opens into the events behind it rather than standing on its own. That is what makes it explainable to a board and auditable to a reviewer. See the reading.

Across Keepnet’s own data the direction is consistent. An employee’s first simulated phishing email is the one they are most likely to click: 9.2%, falling to 4.8% across every simulation that follows. The template difficulty mix stayed flat between the first and the twelfth, so the drop is not explained by easier templates.

Measured one organisation at a time rather than one employee at a time, the median organisation’s click rate fell from 3.4% on its employees’ first simulation to 1.4% by their twelfth, so the finding is not carried by a few large employers.

Keepnet anonymised customer research, email phishing simulations delivered 1 January 2020 to 29 September 2026. Employee figures: employees who received at least 12 simulations (n=102,452 employees across 158 organisations); the 4.8% is the mean across simulations 2 to 12, not a single simulation. Organisation figures: n=158 organisations. Methodology: doc.keepnetlabs.com/resources/research-methodology.

Yes, and they are an expected security control rather than a grey area. NIST SP 800-53 control AT-2(1) reads: “Provide practical exercises in literacy training that simulate events and incidents.” Its discussion names the method: “Practical exercises include no-notice social engineering attempts to collect information, gain unauthorized access, or simulate the adverse impact of opening malicious email attachments or invoking, via spear phishing attacks, malicious web links.”

Three more frameworks require the awareness programme a simulation serves. CIS Controls v8.1 safeguard 14.2 asks organisations to train employees to recognise phishing, at every implementation group including the baseline. PCI DSS v4.0 requires awareness training that covers phishing and social engineering, mandatory since 31 March 2025. DORA makes security awareness programmes compulsory for staff and senior management at EU financial entities.

How you run one is where the care goes. The UK National Cyber Security Centre puts it plainly: “Phishing simulations can also create legal risk.” Employment law, data protection and employee representation rules differ by country. Agree the programme with HR and, where you have one, your works council before the first send. Tell employees that simulations happen. Report on groups rather than on named employees.

NIST SP 800-53 Rev. 5, control AT-2(1). NCSC, Phishing attacks: defending your organisation. General information on security frameworks, not legal advice. Confirm your own obligations with your legal team.

You run it. Keepnet is a phishing simulation platform your own team operates, and the AI agents take as much of the setup and the follow-up as you let them.

You pick the employees, the channels and the schedule, or the agents pick and you approve. Keepnet does not run campaigns on your behalf.

Organisations that offer a phishing simulation service, to their own employees or to client companies, build it on Keepnet rather than buying it as a service. Each simulator can be bought on its own, so that service can start on one channel and add the rest later.

Keepnet’s phishing simulation software is priced on the number of employees and the capabilities you need. You can start with email simulations and add channels such as SMS, voice, QR and callback as your programme grows.

Published prices start at $1.20 per employee per month for Essentials at 501 to 1,000 employees on a three year term. Prices are published to 1,000 employees and quoted above that. See the full price list and every feature.

Employees arrive over SCIM from Entra ID or your own directory, so groups, joiners and leavers stay current instead of being re-imported every month. Sites that share one mailbox rather than hold one each are enrolled the same way. There is no gateway configuration or whitelisting step.

Whitbread moved to Keepnet from KnowBe4. Its security team had been handling every phishing exercise by hand, which at around 32,000 employees took a few days each time. On Keepnet the simulations for all 32,000 are scheduled six months ahead in one go. Read what they did.

Measurement starts where you do. Your first campaigns set the baseline, and the before and after reading runs from there against the target you set and your sector, so the comparison is like for like rather than stitched across two platforms.

Most organisations send their first email phishing simulation within two weeks of the licence starting. Of those that joined Keepnet between January 2025 and June 2026, more than half were inside two weeks and nearly two in three inside 30 days.

There is no gateway configuration or whitelisting step in between. Employees sync over SCIM or file upload, so the first campaign can go out as soon as the list is in.

Keepnet anonymised customer research, email phishing simulations, accounts and licences starting January 2025 to June 2026 (n=428 organisations). Methodology: doc.keepnetlabs.com/resources/research-methodology.