Phishkit by Tribastion runs awareness newsletters, poster campaigns, deepfake-awareness modules, gamified training, and safe simulated phishing, vishing and smishing, delivered only to your own enrolled, consented staff, and measured with a human-risk score that goes down over time.
Every simulation ends in a teachable moment, and when someone types into a fake login page the platform records only that it happened and discards what they typed. No real credential is ever captured. That is a hard, non-configurable rule.
A safe, closed loop: nobody is contacted without consent, nothing sends live without two independent gates passing, and every click becomes a moment to learn.
Import staff as recipients and group them into audiences. Consent is an append-only ledger; a hard unsubscribe is honoured everywhere, forever.
Build a lure and a teachable-moment page. Designing and launching are different permissions, a live send needs a separate approval and an armed channel.
Simulate with zero blast radius, or send live once armed. Opens, clicks and reports are tracked per recipient, a submitted password is never stored.
Every interaction lands on a teachable moment. Behaviour and training completion feed a human-risk score that trends down over time.
Awareness content, simulated social engineering and real training, all built on the same consented audience and measured by the same risk score.
Enrolled staff, grouped into departments and cohorts, the target of every campaign.
Opt-in gates every send; a hard unsubscribe is honoured across every module, always.
Topic-based awareness newsletters, scheduled or one-off, with open and click tracking.
A print-ready awareness artwork library with email-embed and display-board acknowledgement.
Safe simulated social engineering across email, SMS and voice, teachable-moment on every click.
Lessons and "spot the deepfake" exercises on AI-voice and video fraud.
Courses, quizzes and certificates with points, badges, streaks and a leaderboard.
A per-person, per-department and per-org number, driven by real behaviour and training.
Hover or tap a card. The Tribastion platform foundation is live from day one: auth, roles, audit, notifications, search and an open API.
Campaign launches, click-rate spikes and reported phish land in-app immediately, and push to Slack or a webhook if you've connected one.
Ctrl+K from anywhere searches recipients, audiences, scenarios, campaigns and courses at once, filtered to what your role can actually see.
An in-app walkthrough of the whole lifecycle plus a live role guide, read straight from the same RBAC catalog that enforces permissions, never out of sync.
Scoped X-API-Key credentials for a central governance or monitoring platform to pull metrics and results, permissions narrowed, never widened.
The same guardrails that gate a live send also gate who can see and do what, enforced at the query level, not just the UI.
A simulated submission is logged as an event only, what a person types is discarded, never stored.
Nothing goes live unless the platform, the channel and the campaign are each explicitly enabled.
Designing a campaign and launching it live are deliberately different hands.
Every query is scoped to your organisation automatically, enforced by the framework.
A hash-chained log of every consequential action, verifiable end to end.
Sign in to the demo tenant and open a campaign, an audience, or the human-risk dashboard yourself.
Sign in to your console