2.9Signed update wizard, certificate designer and the Compliance posture page are in this release
Phosigil Phosigil
Email us Request a demo
Product

Everything a security awareness programme needs, on one server.

Simulations, training, reporting and the admin controls your security team expects. Installed as a service, run from a browser, backed by one database you own.

Phishing simulations

Lures that look like the real thing, because they are built the same way.

Pick a template and the matching landing page comes with it. Send from your own relay. Watch opens, clicks, submitted forms and reports arrive.

  • 4,000+ email templates

    Vendor look-alikes, internal pretexts, seasonal and role-based lures, tagged by category, vendor, difficulty and channel. Your own logo drops into internal pretexts automatically.

  • Landing pages matched to the lure

    2,900+ pages across 28 form types, paired one-to-one with templates. Capture nothing, presence only, or full form data: your choice, recorded in the posture page.

  • SMS and voice with consent controls

    Smishing and vishing campaigns run through your own Twilio account or our managed relay. A consent gate, quiet hours, caller-ID attestation and a suppression list are on by default.

  • AI personas

    Describe a sender and a scenario; the persona drafts the email, the landing page and the follow-up in your organisation's tone. Sensitive pretexts (pay, health, layoffs) need a second admin to approve.

A running campaign. Sent, opened, clicked, submitted and reported, in the funnel colours used across the product.
Training

Five minutes a month, never the same lesson twice.

Short lessons built around one scenario each, with a quiz and one line the learner can repeat. No videos, nothing unskippable.

  • Training campaigns and a 40-lesson library

    40 lessons in 14 threat families: standard and executive cuts, six high-risk role cuts and six compliance lessons. A rotation rule keeps any one person from seeing a lesson twice.

  • Remediation after a click

    A click can enrol the person in the matching lesson automatically. Rules decide who, how soon and how often, and the remediation page shows who has completed it.

  • Landing-page micro-lesson

    The teachable moment is 60 to 90 seconds long, names three red flags from the exact lure, and tells the person nothing was recorded against them.

  • Certificates with a signature designer

    The certificate is your document: your logo, your wording, up to two signatures drawn or uploaded, issued under your organisation's name. A learner page lists each person's lessons and certificates.

The lesson a click opens: one scenario, three questions, one line to remember.
The certificate is your document. Phosigil appears only as a small footer line, and not at all when white-labelled.
Reporting and evidence

Evidence your assessor can check, not a score.

Phosigil never reduces your programme to one number and never calls a setting compliant. It shows what happened, who acknowledged what, and when.

  • Evidence pack per framework

    One PDF groups campaigns, completions and acknowledgements under the awareness controls of HIPAA, NIST SP 800-53, NIST SP 800-171, NYDFS 500, GLBA, CISA CPGs, PCI DSS, SOC 2, NIST CSF and ISO 27001. Each pack is stored with its SHA-256.

  • Audit log with a hash chain

    Every admin action is appended to a tamper-evident log. Verify the chain from the Compliance page, export it as NDJSON or CSV, or stream it to your SIEM.

  • Per-person transcript

    One export per employee: simulations received, outcomes, lessons completed, certificates earned and policy acknowledgements. Anonymise a person in one step when they leave.

  • Dashboards and scheduled reports

    Human-risk view by department and group, campaign funnels, training completion, and a cyber-insurer metrics summary. Reports can be scheduled and emailed from your own relay.

One evidence pack: each framework's control next to what this quarter actually produced.
The Compliance page reads live settings and says what the install does right now, in words.
Admin and security

Built to pass your own security review.

The controls your team would ask any vendor for, available on day one.

Sign-in

  • Single sign-on with OIDC providers (several at once) and SAML
  • MFA with authenticator apps and passkeys
  • Backup codes and a break-glass account
  • Lockout, IP allow-list, SSO-only mode

Roles and workspaces

  • Admin and operator roles; read-only API keys
  • Workspaces for subsidiaries or MSSP clients, each with its own brand
  • Scoped API keys with expiry
  • Directory sync over LDAP; just-in-time provisioning from SSO

Audit and SIEM

  • Hash-chained audit log with retention you set
  • Syslog streaming (CEF or JSON) over UDP, TCP or TLS
  • Signed webhooks for campaign events
  • Software bill of materials (CycloneDX) with every release

Updates and support

  • Update wizard: signed manifest, checksum and signature verified before apply
  • Automatic checks you can turn off
  • Support channel inside the product; you see exactly what is sent
  • Backup and restore documented for SQLite and MySQL
Software updates. Nothing is applied until the signature and checksum match, and you can roll back for 24 hours.
Next step

Thirty minutes, your server or ours.

We will show you a campaign end to end and answer the security questionnaire while we are at it.

Request a demo Pricing