Turn your people into a human firewall
xPhish runs consented, scoped phishing simulations, teaches at the moment of the click, and measures risk going down — for your team and your clients.
of breaches begin with a human click
of untrained users fall for a lure
fewer repeat clicks after training
consented, scoped and auditable
How it works
Four steps from blind spot to measured, improving risk
Authorise
A signed scope names the domains, people and window. Nothing sends without it.
Simulate
Launch a realistic, on-brand campaign from Orel-owned infrastructure.
Teach
The click opens a teachable moment and assigns short, targeted training.
Measure
Track susceptibility and improvement, from analyst to boardroom.
Platform
Everything a modern awareness programme needs
Campaign engine
Templates, landing pages, scheduling and throttled delivery — events only, never secrets.
Just-in-time training
Micro-modules auto-assigned on a failure, with completion tracking.
Premium dashboards
Funnels, susceptibility gauges, trends and board-ready exports.
Authorisation gate
Every send is checked against a signed, verified, in-scope authorisation.
Multi-tenant & SSO
Per-client isolation with row-level security; SSO for client admins.
Secure by design
Least-privilege access, full audit trail, and no credential capture — ever.
Built on consent
A security tool held to a security standard
Nothing sends without consent
Every campaign is bound to a signed, domain-verified, time-boxed authorisation. There is no override.
We never store what is typed
A submit records that it happened — never the password. The platform has nowhere to put a secret.
Isolated by default
Per-tenant row-level security and least-privilege access, with a full audit trail.
Ready to measure your human risk?
Book a walkthrough of xPhish for your organisation or your clients. Every engagement runs under a signed Rules of Engagement.