Someone on your team will click.

Not because they’re careless. Because the email looks right. Scroll to watch it happen, then watch HukProof make it end differently.

Run a free simulation Watch it happen ↓

WITHOUT TRAINING

Monday, 09:12. An email from “IT Support” arrives.

It lands between real work.

“IT Support” says the password expires in an hour. Same logo, same tone, sandwiched between Marketing and HR.

+00:05s

It looks right.

The sender is acme-corp.io, not .com. There’s a deadline. Nobody checks the domain with a deadline.

+00:13s

The page is a copy.

A lookalike login on acme-corp-secure.co. She types her email. Then her password.

+00:21s

21 seconds. Account gone.

The attacker logs in from Tallinn, replays the session past MFA, and reaches 14 systems. You find out weeks later.

mail.acme-corp.com / inbox

PrimarySocialPromotions

ITIT SupportAction required: password expiring in 1 hour — Reset to keep account access…just now

MMarketingQ3 campaign results — Numbers are in, hit 118% of pipeline target…1h

HHR DepartmentUpdated PTO policy — Please review attached changes for FY26…1h

JMJohn MillerRe: Project timeline — Looks good. Let’s sync tomorrow at 9…2h

FFinanceMonthly expense report — Attached for your review and approval…3h

ZZoomYour meeting recording is ready — Weekly sync · 42 min…4h

CCalendarReminder: 1:1 with Priya at 3:00 PM — Meet link attached…5h

IT Support <support@acme-corp.io>

to sarah.chen@acme-corp.com · just now

Reply⚑ Report

Sender is acme-corp.io, not acme-corp.com. Learned this in last month’s simulation.

Action required: password expiring in 1 hour

Hi Sarah,Our security audit detected your password is set to expire in 59 minutes. To avoid losing access to email and Slack, please reset it immediately using the secure portal below.→ Reset password nowIf you don’t reset before expiry, your account will be locked.— Acme IT · Do not reply · Ticket #SEC-29481

acme·corp

Password

21 SECONDS · NO INTERVENTION

Credentials captured.

+00:00sEmail opened by S. Chen · Sales
+00:08sClick on “Reset password” link
+00:14sLookalike domain loaded · acme-corp-secure.co
+00:21sCredentials submitted · attacker has account access
+00:23sLogin from 104.21.x.x · Tallinn · token issued
+00:42sMFA bypassed via session replay · 14 systems accessible

Time to compromise

21s

Systems exposed

Avg. breach cost

$4.88M

Reported in 9 seconds.

Sarah spotted the sender mismatch, hit Report, and the lure was quarantined for the whole company.

Time to report

412

Teammates protected

Breach cost

01 · Inbox+00:00s

NOW REWIND

Same email. Different ending.

Same Monday, same lure, sent to a team that’s been on HukProof for 90 days.

mail.acme-corp.com / inbox

PrimarySocialPromotions

ITIT SupportAction required: password expiring in 1 hour — Reset to keep account access…just now

MMarketingQ3 campaign results — Numbers are in, hit 118% of pipeline target…1h

HHR DepartmentUpdated PTO policy — Please review attached changes for FY26…1h

JMJohn MillerRe: Project timeline — Looks good. Let’s sync tomorrow at 9…2h

FFinanceMonthly expense report — Attached for your review and approval…3h

ZZoomYour meeting recording is ready — Weekly sync · 42 min…4h

CCalendarReminder: 1:1 with Priya at 3:00 PM — Meet link attached…5h

IT Support <support@acme-corp.io>

to sarah.chen@acme-corp.com · just now

Reply⚑ Report

Sender is acme-corp.io, not acme-corp.com. Learned this in last month’s simulation.

Action required: password expiring in 1 hour

acme·corp

Password

21 SECONDS · NO INTERVENTION

Credentials captured.

+00:00sEmail opened by S. Chen · Sales
+00:08sClick on “Reset password” link
+00:14sLookalike domain loaded · acme-corp-secure.co
+00:21sCredentials submitted · attacker has account access
+00:23sLogin from 104.21.x.x · Tallinn · token issued
+00:42sMFA bypassed via session replay · 14 systems accessible

Time to compromise

21s

Systems exposed

Avg. breach cost

$4.88M

Reported in 9 seconds.

Sarah spotted the sender mismatch, hit Report, and the lure was quarantined for the whole company.

Time to report

412

Teammates protected

Breach cost

01 · Inbox+00:00s

AFTER 90 DAYS ON HUKPROOF

09:12, Monday

The same email lands.

Nothing about the attack changed. The person reading it did.

+00:05s

Sarah spots the .io

Last month she clicked a HukProof simulation and got a 30-second lesson on exactly this trick. It stuck.

+00:09s

One click: Report.

The lure is quarantined for the whole company, and her report shows up on your dashboard. Breach cost: $0.

Same team. 90 days later.

Day

Click rate%from 31% on the first send

People at risk%industry baseline 33.2%

Repeat offendersfrom 11, re-targeted automatically

Safe-habit rate%across 6 campaigns

CLICK RATE · WEEKLY31% → 4%

Day 0Day 90

PEOPLE AT RISK · WEEKLY33.2% → 4.2%

Day 0Day 90

REPEAT OFFENDERS · WEEKLY11 → 3

Day 0Day 90

SAFE-HABIT RATE · WEEKLY66.8% → 95.8%

Day 0Day 90

Illustrative program. At-risk rates are based on the KnowBe4 2026 industry benchmark.

Set it up once. Every loop makes them harder to fool.

app.hukproof.com / campaigns / q3-simulation

Q3 simulation

Results in 48h

Sent

Opened

63Clicked

29Submitted

Who clicked, ranked by risk

High

Medium

Low

PART 2 OF 4

Spot the signs: the email you clicked

acme-c0rp.com1

expires in 2 hours2

Reset password →3

3 of 3 red flags found

1Lookalike domain

2Fake urgency

3Link goes elsewhere

Continue

Dashboard

Export PDF

Click rate4%↓ 27 pts

Repeat offenders3↓ from 11

Safe-habit rate95.8%↑ 29 pts

Click rate · last 6 campaigns

31%4%

Automations

3 rules on

Rules

Re-target repeat clickers12 people re-enrolled

Rotate fresh templates8 new lures this quarter

Coach on every clickLesson sent within 1 second

Upcoming sendsNext: Sales, Finance · Tue

W1W2W3W4W5W6W7W8W9W10W11W12

Four ways to train your team. One you can start today.

Hire a consultant

Enterprise suite

KnowBe4, Proofpoint

Do nothing

HukProof

Time to first simulation

Weeks of scoping and a proposal

After a sales cycle and onboarding

Never, until a real attack

Today

Who runs it

The consultant, on their schedule

A dedicated admin, ideally security staff

Nobody

You. No security background needed

How people learn

An annual workshop or slide deck

Assigned courses from a library

They don’t

A 30-second lesson on the email that fooled them

Pricing

Day rates

Quote-based, usually annual

$0 until a breach ($4.88M average)

Free to 100 people · Pro $29/mo

Evidence for leadership

A report at the end

Yes, once configured

None

Board-ready PDF, any time

This is a general comparison. Vendor packaging and terms vary, so check each vendor for current details. Breach figure: IBM Cost of a Data Breach 2024.

Everything a security consultant would build you.

Describe it in one line. HukProof writes the attack.

The lure, the lookalike sender and a brand-matched login page, modelled on attacks going round right now.

Describe an attack in one line…↑

DocuSign

docs@acme-sign.co

Lookalike sender

Contract awaiting your signature

Fake urgency

Review documentBrand-matched page

Lookalike domains, set up for you.

One character off is all an attacker needs. HukProof registers them so your people learn to look.

acme-corp.comYours
acme-c0rp.comzero for o
acme-corp.ioTLD swap
acrne-corp.comrn for m
acme-corp-secure.coadded word

A 30-second lesson, the moment they click.

Built around the exact email that fooled them. No videos, no quizzes, no LMS logins.

Clicked the link09:14:02

Lesson opened09:14:03

Finished in 34 seconds09:14:37

Next simulation: reported it+30 days

See which teams need help, ranked.

Click rate, repeat offenders and report rate for every department, with nothing to configure.

Sales34%

Finance26%

Support15%

Ops9%

Eng6%

Needs attentionSales3× the company average

A board-ready report in one click.

Coverage, results and an audit-log excerpt, ready to hand to leadership or attach to your own compliance evidence.

Q3 Security Awareness✓ Exported

100%

Coverage

Click rate

90d

Audit log

SHA-256 · 9f2c…e41a

Then it runs itself.

Repeat clickers get re-targeted, templates rotate, and the next send is already scheduled.

Re-target repeat clickers

12 people re-enrolled

Rotate fresh templates

8 new lures this month

Schedule the next send

Monday 09:00 · Sales and Finance first

Free until you’re ready.
Then $29 a month.

FREE

$0forever

Everything a small team needs to run its first realistic simulation. No card.

Up to 100 employees2 campaignsDashboard, PDF report and training

Start free

PROBilling opens soon

$29/ month

Up to 200 employees, then $0.50 per employee per month.

Up to 1,000 employeesUnlimited campaignsEverything in Free

SCALE

Custom

For 1,000+ people. Priced to your program.

Up to 5,000 employeesSSO: SAML + SCIM (planned)A dedicated contact

Talk to us

What would it save you? Work out your three-year savings in the calculator.Open the calculator →

Questions, answered.

Something else? A person who works on HukProof replies at support@hukproof.com.

Yes. You allowlist HukProof’s sending servers once (we walk you through Google Workspace and Microsoft 365), and simulations land like real mail.

Most teams send their first simulation the same day: verify your domain, import your people, pick a template.

No. The fake login page records that a submit happened, never what was typed.

A short page showing the exact email they clicked, with the red flags marked. There’s no quiz and no login, and it takes about 30 seconds.

Yes. No card and no setup fee. Up to 100 employees and 2 campaigns, with the same dashboard, PDF report and team-wide training.

You can export a board-ready PDF with coverage, results and an audit-log excerpt to attach to your own evidence.

Find out who clicks before an attacker does.

Free for up to 100 people. No card, no consultant, no three-month onboarding.

Run a free simulation Talk to us