Skip to content
PHISHNOVA

Two-minute readiness check

How exposed is your awareness program?

Seven questions across the dimensions that decide whether a program measures real risk or just produces a click rate. No email required, nothing stored — the result appears on this page and goes nowhere else.

0 / 7
  1. 01Which channels do you actually simulate?

    Attackers use SMS, voice and WhatsApp precisely because people drop their guard there.

  2. 02How often do simulations run?

    A once-a-year blast tests recognition of last year’s attack, and everyone warns each other.

  3. 03What happens when someone clicks?

    The teachable moment is the second of the click, not a digest next week.

  4. 04How is risk measured?

    An org-wide click rate hides the twelve people who account for most of your exposure.

  5. 05Where do your lures come from?

    A static library trains people for attacks that have already moved on.

  6. 06Could you evidence the program to an auditor tomorrow?

    Under DPDP, training that left no structured record is hard to distinguish from training that never happened.

  7. 07Where does your vendor’s AI send employee data?

    Risk scores, roles and behaviour are the most sensitive people-data you hold.

Answer all 7 to see where you stand. 7 left.