Smishing simulator
Smishing simulations that turn risky taps into reports
Secure behaviour you can measure and show the board.
Measure SMS risk across your regions from day one
8,400+ ready-made scenarios in 29 languages, with training after every tap.
SMS, landing page and training in one package, with the red flags marked.
A routine request, with a link that is not your learning portal.
- An SMS with a link, for something your learning portal would normally send by email.
- The address is not your learning portal.
- Your first name makes it feel familiar. A name proves nothing about the sender.
Goodwill and curiosity, with no urgency at all.
- No team or survey name. "We" could be anyone.
- The link is not your survey tool.
- No urgency at all. Friendly requests are the ones that get the least scrutiny.
A plausible date and time. The link is the only ask.
- A date and time make it read as official.
- A maintenance notice does not need you to open a link.
- Check the status page you already know, not the one in the SMS.
The SMS prepares the employee. The email that follows carries the link.
SMS, landing page and training in one package, with the red flags marked.
None of it starts from a blank page
- 8,400+SMS scenarios
- 29languages for the SMS
- 3,500+landing pages
- 17merge tags to personalise the SMS
Click-only, data submission, MFA code, or several methods in one campaign.
Trusted every day by security teams that measure behaviour, not attendance
Phones sit outside your email defences
Your email filters do not see an SMS.
How a smishing simulation works
Send, train, measure
One campaign wizard, five steps.
1. Send
Pick scenarios, groups and countries.
- Local numbers, chosen by country
- Several scenarios, spread at random
- One-off or recurring schedules
2. Train
A short lesson at the tap, or by email later.
- Coaching straight after the tap
- The red flags of that SMS, explained
- Reminders and a certificate
3. Measure
Delivery, clicks and reports, per employee.
- Delivery status for each SMS
- Clicked, submitted, no response
- A report you can download
The real console, not a video
Build a campaign, see the coaching after a tap, then read the report.
Click to start a live preview
No form, no sales call. Best in landscape on a phone.
Start the tourThe interactive product tour of the Keepnet console
The tour will not open in this page
Your browser or network is blocking the embedded frame.
Open the tour in a new tabLocal numbers in your employees' countries
Our most used countries. Many more on request.
+44 7••• •••••• United Kingdom · English
+1 •••-•••-•••• United States · English
+90 850 ••• •••• Türkiye · Türkçe
+1 •••-•••-•••• Canada · English+1 •••-•••-•••• Canada · Français
+61 4•• ••• ••• Australia · English
+55 11 •••••-•••• Brazil · Português
+48 ••• ••• ••• Poland · Polski
+41 7• ••• •• •• Switzerland · Deutsch+41 7• ••• •• •• Switzerland · Français+41 7• ••• •• •• Switzerland · Italiano
+63 9•• ••• •••• Philippines · TagalogDelivered at 10:15 local time, inside working hours in London.
Keepnet-owned numbers
No telephony account or sender registration on your side.
A2P 10DLC in the US
We complete carrier registration with our providers.
Dedicated numbers
Available for enterprise customers, subject to agreement.
Keepnet platform data, SMS simulations 1 January to 14 August 2026 (n=47 organisations).[5]
An SMS that sets up the email
The SMS prepares. The email carries the link.
1 The SMS No link. It only makes the next email expected.
Following our SMS, please confirm your benefits choices here.
2 The email It refers back to the SMS and carries the link.
Reported A thank-you, and the report counts as the right behaviour.
Clicked A short lesson on the signs in both the SMS and the email.
3 The outcome One result, across both channels.
SMS is one channel. Email, calls and QR codes run alongside it in the multi-channel phishing simulator.
Scenarios in your company's voice and language
- Your own SMS in minutesFrom a library scenario or a blank SMS.
- AI that sharpens itEnhance sharpens it; the red flag preview shows how it reads.
- Personal to each employee17 merge tags, from first name to company.
- In their own languageSMS in 29 languages, landing pages in 60.
The right employees, at the right time
Where it is already running
Teams running Keepnet, in their own words.
Agentic AI
Agents build the campaign, you approve it
Ask in plain English. Approve the draft before it runs.
Approval by default. Autonomy only if an admin allows it.
See Agentic AICreate an SMS scenario on benefits enrolment for new hires in the UK and the US.
- Channel
- SMS
- Audience
- New Hires
- Languages
- English (United Kingdom), English (United States)
- Method
- Click-only
- Training
- Coaching at the click
Employees report the SMS in one tap
Each report counts as secure behaviour.
Recent reportsSMS and calls, each with its result. 
The verdictWith the reasons and what to do. 
Report historyFilter by SMS or calls, and by result.
- One tap to reportFrom the app, or from the Messages junk-reporting flow on iPhone.
- The right behaviour, countedA reported simulation shows on the employee's record.
- STOP is respectedSTOP and opt-outs are respected in later campaigns.
- Only what the employee reportsThe app does not read messages or record calls.
Suspicious SMS that are not simulations go to your security team in Incident Responder.
See whether smishing simulations change behaviour
- Clicked, submitted and no responsePer employee, with a tab for each.
- Delivery for each SMSAn SMS that never arrived is not a good result.
- Employee activity, not scannersClicks marked by activity type; your own IPs left out.
- Download the reportAnd read SMS next to email, call and QR results in Reporting.
The tap becomes the lesson
The live coaching page, played through.
Questions to ask a smishing simulation vendor
The answers that matter in your countries.
| Question | Keepnet |
|---|---|
| Which countries can you send from? | Nine most used. Many more on request, subject to each country’s SMS rules. |
| Can you show how many SMS arrive? | Yes. Delivery status for each SMS, and a 95.5% median delivery to the handset across organisations in 2026. |
| Whose numbers are they? | Keepnet-owned. Dedicated numbers for enterprise customers, by agreement. |
| Who handles US carrier registration? | Keepnet, through A2P 10DLC with our providers. |
| Do we run it, or do you? | You run it from the console. |
| How do employees report an SMS? | Keepnet SMS and Call Reporter, on iPhone and Android. |
| Are opt-outs respected? | Yes. Recorded and applied automatically. |
| Can we buy it on its own? | Yes. |
The evidence is published, not on request
Four current certifications, independently audited. Certificates and the full control set are published at doc.keepnetlabs.com/resources/compliance.
Pricing
Buy the smishing simulator on its own
Priced per employee, as part of the secure behaviour management platform.
See the plan prices- Pay only for what you runStart with one simulator and add the rest later.
- Priced per employeeThe more employees you cover, the less you pay per employee.
- Add to what you runSMS simulations next to the email provider you already use.
- Try before you commitTry and buy, or a proof of value with your own employees.
"It would be unfair to single out just one feature. The mail scenarios and customisable training modules are particularly excellent."
"It's a really great platform with a lot of flexibility to ensure our requirements are met. Onboarding was friendly, enjoyable, and thorough."
"It's super easy and intuitive to setup campaigns, whilst making it easier for end-users to report phishing emails."
"The product itself works great on day one and delivers immediate value as our team was able to get started with our phishing exercise program immediately."
"It has been consistent, reliable, and implementations over time shows that they really listen customer feedback."
"We've seen a noticeable improvement in how employees react to suspicious emails or phone calls- because they remember the stories."
"Within minutes, we can create realistic, scenario-based templates specific to our organization, reducing setup time while increasing the relevance of training."
"The simulations and campaigns are very customisable and realistic."
"Thanks to Keepnet's Incident Response tool, we reduced the e-mail analysis and response time, which used to take hours, to 2 minutes."
Keepnet Labs has a rating of 4.9 out of 5 based on 104 ratings in the Security Awareness Computer-Based Training market on Gartner Peer Insights as of October 2026. GARTNER is a registered trademark and service mark, and PEER INSIGHTS is a trademark and service mark, of Gartner, Inc. and/or its affiliates, and are used herein with permission. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates.
What buyers ask about smishing simulation
Short answers first.
A smishing simulation sends realistic, harmless SMS phishing messages to employees' phones and shows who taps the link and who reports it.
Employees who tap get short coaching straight away, so each campaign builds safer habits on a channel your email filters do not see.
You pick a scenario, choose target groups and schedule the send in one campaign wizard.
Keepnet sends the SMS from a local number, records taps and reports, and opens a coaching page for anyone who taps.
An SMS reaches the employee's phone with no email filter in between.
Verizon's 2026 DBIR puts the median click rate in phone-based simulations about 40% higher than in email ones.
In most countries, yes, when the simulation is part of a documented security programme and follows local employment and data protection law.
This is not legal advice. Check with your counsel, and with your works council where you have one.
Most organisations tell employees that simulations run, without saying when.
For personal phones, many limit simulations to company numbers or ask employees to opt in. You choose the target groups, so you decide whose numbers are used.
From your directory or the API.
Keepnet imports employees with their phone numbers through your directory integration, so groups stay current as employees join and leave.
From Keepnet-owned local numbers in the employee's country. You do not need your own sender ID or telephony account.
Dedicated numbers are available for enterprise customers, subject to agreement. In the US, Keepnet completes A2P 10DLC carrier registration with its providers.
Our most used countries are the UK, the US, Türkiye, Canada, Australia, Brazil, Poland, Switzerland and the Philippines.
Many more are supported, subject to each country's SMS rules, and new ones are added regularly. Tell us which countries you need when you book a demo.
A short coaching page opens straight away and shows the red flags they missed.
It covers the SMS they received, the warning signs in it and what to do next. Training can also be sent by email later.
With the free Keepnet SMS and Call Reporter app for iPhone and Android.
A reported simulation counts as the right behaviour on the employee's record. Suspicious SMS that are not simulations go to your security team.
Look past the tap rate. Track how many employees report the SMS, and compare taps and reports across campaigns.
Keepnet reports each result per employee, with delivery for every SMS, so the change in behaviour is clear to show the board.
Most teams settle on a regular rhythm, such as monthly or quarterly, alongside their other channels.
The console runs campaigns one-off, weekly, every two weeks, monthly or quarterly, and smart groups such as repeat clickers can get more.
Yes. It can be bought on its own, priced per employee, or inside a plan with Keepnet's other simulators and training.
Yes. A multi-channel scenario can send an SMS first and follow it with the email that carries the link.
The result shows whether the SMS made the email more convincing, and the lesson covers the signs in both.
See it with your countries in mind
- An SMS from your own countryLocal number, language and working hours.
- One campaign, end to endScenario, employees, schedule and report.
- What employees seeThe SMS, the landing page and the coaching.
- Your rolloutCountries, groups and the SMS and Call Reporter app.
Book a demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tabSources
- Keepnet console, dash.keepnetlabs.com, Keepnet demo tenant, read 15 October 2026: Smishing Simulator scenarios, campaign wizard, SMS Settings (countries and numbers), target groups, schedule and the campaign report. Names, numbers and domains are masked.
- Keepnet content library statistics, stats.keepnetlabs.com, 15 October 2026: SMS phishing scenarios, SMS templates and their languages, landing pages and merge tags.
- Gartner, “Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management” (G00860839, September 2026), 2026 Gartner CISO Role Survey (n=297). GARTNER is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
- Verizon, 2026 Data Breach Investigations Report, p. 50. Median click rates in phishing simulations: about 2% for phone-based and about 1.4% for email, so roughly 40% higher on phones. Keepnet is a contributor.
- Keepnet platform data, SMS simulations delivered 1 January to 14 August 2026, queried 14 August 2026. Organisations that consented to anonymised campaign data being used in Keepnet research; internal, test, demo and trial tenants removed (n=47 organisations, 13,069 messages). Delivered means the carrier returned a delivery receipt. An operational measure from Keepnet’s own platform, not an industry benchmark.
- Keepnet documentation, doc.keepnetlabs.com: Smishing Simulator and the Keepnet SMS and Call Reporter app.
Page reviewed