Most incidents still begin with a person: a clicked link, a credential typed into a fake page, a phone call that sounded legitimate. Our proprietary platform simulates those attacks across email, SMS and voice, trains people at the moment they are most receptive, and turns the human layer into measurable, improving data.
Built by our incident responders rather than by a training vendor, the platform reproduces the techniques we see in real cases: credential harvesting against the authentication portals you actually use, fake ticketing and approval requests, delivery and payroll lures, and voice calls that impersonate IT or management.
It is delivered as a managed service or as a tenant your security team operates, with campaigns designed and reviewed by analysts, and it integrates with the reporting workflows of Microsoft 365 and Google Workspace so that every simulation also strengthens your SOC.
Every wave produces delivery, open, click, credential and report-to-SOC rates by group and over time, against the thresholds you set. The trend lines tell leadership whether the programme is working; the group breakdown tells the security team where to focus.
Delivery notices by SMS, credential prompts on cloned portals, calls from "IT" and "finance": the scenarios reproduce current tradecraft across email, SMS and voice, so that people are tested where attackers really operate.
Phishing by email, smishing by SMS and voice-based social engineering including call spoofing, so that awareness is tested where attackers actually operate, not only in the inbox.
Lures modelled on current campaigns in your sector, on incidents we have investigated and on the platforms your people use every day: identity providers, collaboration tools, HR and finance systems.
A user who interacts with a simulation receives a short, specific lesson immediately, when the context is fresh. No annual slide deck, no generic quiz.
Campaign difficulty and frequency tuned by role and exposure: executives, finance, privileged administrators, developers with pipeline access, external-facing teams.
Delivery, open, click, credential-submission and report-to-SOC rates, tracked per campaign, per group and over time, with corporate thresholds and trend lines.
A one-click reporting button in the mail client turns suspicious messages into SOC tickets and measures the indicator we consider decisive: how many people report rather than how many click.
A planned programme of waves across the year, randomised within windows so that results reflect behaviour rather than anticipation.
Board-ready dashboards and evidence packs for NIS2, DORA, ISO/IEC 27001 and cyber insurance questionnaires that ask for awareness programmes with measurable outcomes.
An initial campaign establishes current click, credential and reporting rates by group, without blame and without prior announcement beyond leadership.
Analysts design scenarios from your sector's threat landscape and your technology stack, with legal and HR safeguards agreed up front.
Waves run through the year across email, SMS and voice, with instant micro-training for anyone who interacts.
KPIs are reviewed quarterly against thresholds, high-risk groups receive targeted attention, and the SOC reporting loop is tuned.
Clear, usable outputs for executives, technical teams, insurers and regulators.
No. The platform is developed and operated by Aureon's own team. Scenarios, metrics and integrations reflect what our responders see in real incidents, and we control the roadmap.
Programmes are agreed with leadership, HR and legal before launch. Results are used to improve controls and training, reported in aggregate, and never to penalise individuals. Voice scenarios follow strict scripts and recording rules.
Typical corporate targets are interaction rates (clicks, credential entry) below 5 percent, reporting rates above 50 percent and credential submission at zero, reviewed as part of the maturity programme.
Yes. Most clients choose a managed programme where our analysts design, run and report the campaigns. Larger security teams can operate their own tenant with our support.
Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.
Read article
Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.
Read article
In September 2025 a single supplier's passenger handling system went down and three of Europe's busiest airports fell back to pen and paper. A year on, September 2026 brought a state government leak, a hypervisor exploit in ransomware hands and a transport group knocked offline. The pattern holds.
Read articleWant to know how your people respond to a real attack? Ask for a baseline campaign.