Phishkit by Tribastion runs awareness newsletters, poster campaigns, deepfake-awareness modules, gamified training, and safe simulated phishing, vishing and smishing — delivered only to your own enrolled, consented staff, and measured with a human-risk score that goes down over time.
Every simulation ends in a teachable moment, and when someone types into a fake login page the platform records only that it happened and discards what they typed. No real credential is ever captured — that is a hard, non-configurable rule.
A safe, closed loop: nobody is contacted without consent, nothing sends live without two independent gates passing, and every click becomes a moment to learn.
Import staff as recipients and group them into audiences. Consent is an append-only ledger; a hard unsubscribe is honoured everywhere, forever.
Build a lure and a teachable-moment page. Designing and launching are different permissions — a live send needs a separate approval and an armed channel.
Simulate with zero blast radius, or send live once armed. Opens, clicks and reports are tracked per recipient — a submitted password is never stored.
Every interaction lands on a teachable moment. Behaviour and training completion feed a human-risk score that trends down over time.
Awareness content, simulated social engineering and real training — all built on the same consented audience and measured by the same risk score.
Enrolled staff, grouped into departments and cohorts — the target of every campaign.
Opt-in gates every send; a hard unsubscribe is honoured across every module, always.
Topic-based awareness newsletters, scheduled or one-off, with open and click tracking.
A print-ready awareness artwork library with email-embed and display-board acknowledgement.
Safe simulated social engineering across email, SMS and voice — teachable-moment on every click.
Lessons and "spot the deepfake" exercises on AI-voice and video fraud.
Courses, quizzes and certificates with points, badges, streaks and a leaderboard.
A per-person, per-department and per-org number, driven by real behaviour and training.
Hover or tap a card. The Tribastion platform foundation — auth, roles, audit, notifications, search and an open API — is live from day one.
Campaign launches, click-rate spikes and reported phish land in-app immediately — and push to Slack or a webhook if you've connected one.
Ctrl+K from anywhere searches recipients, audiences, scenarios, campaigns and courses at once — filtered to what your role can actually see.
An in-app walkthrough of the whole lifecycle plus a live role guide, read straight from the same RBAC catalog that enforces permissions — never out of sync.
Scoped X-API-Key credentials for a central governance or monitoring platform to pull metrics and results — permissions narrowed, never widened.
The same guardrails that gate a live send also gate who can see and do what — enforced at the query level, not just the UI.
A simulated submission is logged as an event only — what a person types is discarded, never stored.
Nothing goes live unless the platform, the channel and the campaign are each explicitly enabled.
Designing a campaign and launching it live are deliberately different hands.
Every query is scoped to your organisation automatically — enforced by the framework.
A hash-chained log of every consequential action, verifiable end to end.
Sign in to the demo tenant and open a campaign, an audience, or the human-risk dashboard yourself.
Sign in to your console