Phosigil sends realistic phishing simulations from your own relay, turns every click into a ninety-second lesson, and hands your auditor the evidence. It installs on a Windows or Linux server you already have. Employee data never leaves your network.
Built for US organisations that cannot send employee data to a cloud vendor: healthcare, finance, public sector, defence suppliers and the MSSPs that serve them.
Email, SMS and voice lures from 4,000+ templates, each paired with a landing page that matches it. Opens, clicks, submitted forms and reports arrive as they happen.
Phishing simulationsA click opens a micro-lesson on the spot and can enrol the person automatically. 40 lessons across 14 threat families, with quizzes and certificates your organisation signs.
TrainingEvery result, acknowledgement and setting lands in an evidence pack grouped by framework, backed by a hash-chained audit log and a transcript for each person.
Reporting and evidenceScroll
Names, email addresses, click events, training records and the audit log live in your database. The install talks to one host, gateway.phosigil.com, for licence check-in, signed updates and the content library. Nothing else, unless you configure it.
gateway.phosigil.com:443.No containers, no cloud account, no professional services. A Windows or Linux server you already have is enough.
Run the signed installer on a Windows server, or the shell installer on Linux. It bundles the runtime, registers a service and tests its one outbound connection before it finishes.
Upload a CSV, or sync from your directory over LDAP or single sign-on. Departments and groups come across with it. Add your mail relay as a sending profile.
Pick a template; the matching landing page is already attached. Choose the audience and the schedule. Opens, clicks, submitted forms and reports arrive in the campaign view as they happen.
Phosigil holds no certifications and never labels a setting as compliant. It records what you did, when, and who acknowledged it, then groups that evidence under the awareness and training controls of common frameworks. Confirm clause references and scope with your assessor.
Also included: notice templates for CCPA and New York Labor Law §52-c, a second-approver gate for sensitive pretexts, and per-person export and anonymisation.
Cloud products are convenient. They also hold a list of every employee, every click and every mistake, outside your control. Here is where Phosigil differs.
| Question | Cloud SaaS | Phosigil on-prem |
|---|---|---|
| Where do employee names, addresses and results live? | In the vendor's cloud, usually multi-tenant. | In your database, on your server. |
| Who can read them? | The vendor's staff and sub-processors, within their policies. | Only the people you grant access to. We have no access path. |
| What does a vendor outage do? | Campaigns, training and reports stop. | Nothing stops. The licence keeps working for 14 days without our gateway. |
| What must your web filter allow? | The vendor's domains, CDNs and tracking hosts. | One host name on port 443. |
| Where do simulation emails come from? | The vendor's mail infrastructure, allow-listed in your mail filter. | Your own relay, email API or mailbox. |
| Paperwork | DPA, sub-processor list, transfer assessments for every data class. | Employee data is not transferred. A DPA or BAA covers the optional managed relays only. |
A demo takes thirty minutes. We can install on a test machine you control, or walk you through ours.
