Measure the Defense.
Not Just the Click.
PhishArmory goes past pass/fail click testing to quantify how your workforce actually behaves under attack — who defended the organization, how fast, and how genuinely they engaged with the training that got them there. Real behavioral telemetry, an active-defense ratio your board can read in one number, and an append-only, tamper-resistant record of every action taken along the way.
Four numbers a CISO can actually stand behind
Every one of these is computed from data the platform already captures — not a survey, not a self-report, a direct measurement of behavior.
Resilience Index
The click-to-report ratio, as a single number: how many employees actively defended the organization for every one who fell for the lure. Above 1.0 means your workforce is net-positive defense, not just "somewhat tested."
Operational Velocity (MTTD)
Mean Time to Defend: how fast this campaign produced its first real catch, campaign-wide — the same "time to detect" instinct your SOC already applies to every other incident, now applied to the human layer.
True Engagement Telemetry
Every simulated click leads to a Teachable Moment: an annotated breakdown of exactly which red flags gave the lure away, followed by a short quiz that checks whether the lesson generalizes to a different email — not just the one they were caught by. We track how long someone actually read it and how far they scrolled, too. A 2-second "I understand" click and a genuine 45-second review look identical to a survey. They don't look identical here.
Role-Specific Risk Profiling
Lures are generated against a specific persona and role context, not a generic template blasted at everyone — and results roll up by department, so risk profiling reflects who someone actually is at your organization, not a one-size-fits-all pretext.
Honest, Noise-Filtered Reporting
Corporate mail security tools open and scan links automatically, long before a human ever sees the message. Our reporting distinguishes that automated background activity from genuine employee engagement — so your open and click numbers reflect what your people actually did, not what your own security stack did on their behalf.
Stop tracking vanity metrics.
Start measuring real behavioral change.
A click rate alone tells you almost nothing about whether your organization is getting safer. Resilience Index, Operational Velocity, and Engagement Telemetry tell you whether people are actually defending, how fast, and whether the training is landing — the difference between a report you file and a report you can act on.
| Legacy Phishing Simulators | PhishArmory HRM |
|---|---|
| Click rate as the headline metric | Resilience Index — active defenders vs. compromised targets |
| "Training completed" = button clicked | True Engagement Telemetry — verified dwell time and scroll depth |
| No sense of response speed | Mean Time to Defend — operational velocity, SOC-style |
| One generic template for everyone | Persona- and role-aware lure generation, department-level rollups |
| Bot/scanner traffic silently inflating your numbers | Automated noise filtered out — reporting reflects real human behavior |
| A PDF nobody reads twice | A living resilience trend line, cycle over cycle |
Lures Built for the Role — Not One Template Blasted at Everyone
Every simulation is generated for the specific job function it's testing, and every AI-drafted template is reviewed and approved by your team before it's ever used.
Role- and Department-Aware
Lures are generated against the actual job function they're targeting — a wire-transfer pretext for Finance, an access-request pretext for IT, a records notice for HR — not one generic template reused with a different logo.
On-Brand, Contextually Accurate
Simulations can be generated with awareness of your own public brand presence — logo, colors, and company language — so what employees see looks like it actually came from inside your organization, not a stock phishing template.
Realistic Internal-Sender Simulation
Test the scenario behind the costliest real-world attacks: a message that appears to come from a real colleague inside your own organization. Off by default — available only with your organization's explicit, on-file consent.
Reviewed Before It's Ever Sent
AI-generated content is never launched automatically. Every generated template requires an operator to review and approve it before it can be used in a live campaign — a human decision, every time.
One System, Start to Finish — Not Bolted to a Third-Party Tool
Delivery, tracking, and reporting all run on infrastructure we built and operate — not a separate open-source sending tool your security team has to trust, patch, and reconcile against on the side.
Sends Through Your Real Mail Path
Campaigns go out through your organization's own verified mail infrastructure — Microsoft 365 delegated send or your configured SMTP relay — the same path a real phishing email would actually use, not a generic bulk-mail sending pool.
QR / Quishing, Attributable Per Recipient
QR-code phishing simulations are generated individually for each recipient, so a scan is tied to the person who scanned it — not a single shared code that leaves you guessing who actually engaged.
One Audit Trail, Not Two Tools' Worth
Because sending and tracking happen in the same system that generates your reports, there's no gap to reconcile between what a separate delivery tool claims happened and what the reports you receive actually show.
Backend mechanics, translated for the boardroom
Every card below names the actual internal artifact behind it — not marketing shorthand. If your team asks "how does that actually work," this is the honest answer.
Auto-Generated, Per-Client Verification Header
The app generates a unique, cryptographically random header value for every client and seals it at rest — nothing for your team to invent or pre-configure. Your PhishArmory team reveals it from their dashboard and hands it to you directly, for your own security/SOC team to configure as an allowlist rule — regenerated any time you suspect it's been exposed.
Audit-Grade Atomic Telemetry
Engagement and dwell-time telemetry is computed with a single atomic SQL expression at the database layer, not read-modify-written in application code — so concurrent events can never silently overwrite a truer, larger reading.
Persistent Pretext Domains
Pretext domains are a stable, named pool your team manages once — not disposable, auto-rotated infrastructure. The same domain maps to the same training scenario over time, so you can track improvement against it.
Maker-Checker Dual Approval
Every campaign can require a second, distinct approver before it launches — and the system enforces that a creator can never approve their own campaign. Segregation of duties, not a policy you have to remember to follow.
RBAC-Gated Access Logging
Per-recipient results are visible only to Operator/Admin roles — and every time someone with access actually opens that detail view, the view itself is logged with user agent and IP. We audit reads, not just writes.
Host-Isolated Envelope Encryption
Every credential gets its own single-use data key, which encrypts that secret and is itself wrapped by a master key that lives only in this host's environment — never in the database. A stolen database dump alone is never enough to decrypt anything: defense-in-depth against exactly the database-layer exploitation a leaked backup or SQL-injection read represents. Access beyond that is exclusively via high-privilege, re-authenticated administrative break-glass interfaces, backed by append-only audit logging.
Enforced Admin MFA
Every operator account requires TOTP-based multi-factor authentication to sign in — enforced at the platform level, not an optional toggle an admin can leave off. The same envelope-encryption scheme protecting API credentials protects these MFA secrets at rest.
One audit-grade dataset, four ways to read it
Every number below already exists in the platform today — ORI trending, vector-performance heatmaps, median TTR, and department-level breakdowns. These are the four audiences that actually read them.
Executive Brief
Month-by-month Organizational Risk Index trending against a rolling baseline — and against your own industry's benchmark click rate, not just a generic average — plus the plain-language posture summary a board actually reads. Pulled from the same Underwriting/Audit report your admins already export.
Operational Ledger
Vector-performance heatmaps, time-to-click and time-to-report medians (not just one blended number), a full per-recipient event timeline, and per-department click/report rates — the engineering-depth numbers that drive the next training cycle. Pulled from the per-campaign Executive Report.
Regulatory Compliance Attestation
The same insert-only audit log and framework mapping described on our compliance page — packaged as an evidence export for your auditor, cross-referenced against SOC 2, HIPAA, CMMC, NERC CIP, PCI DSS, NIST CSF 2.0, and GLBA/SEC 17a-4.
Risk Underwriting Dossier
A structured technical-controls history — training cadence, ORI trend, remediation completion — of the kind underwriters request at renewal. We don't set your premium; we give you the defensible evidence trail to bring to that conversation.
Roll Multiple Campaigns Into One Assessment
Group campaigns together into a single named Assessment — by quarter, by office, by business unit — and get one combined report instead of stitching results together from a dozen individual campaigns by hand.
Location-Level Drill-Down
If your organization runs multiple offices or locations, an Assessment report shows both the combined result and a per-location breakdown side by side — so you can see exactly which office needs attention, not just a single company-wide average.
Built for the sectors where a mistake is expensive
The same architecture, pointed at four very different failure modes. Each has its own dedicated deep dive.
Financial Services
Fraud-engine isolation, by design — simulation traffic your own detection systems can tell apart from the real thing.
Read more →Healthcare
Zero PHI touchpoint, full audit trail — workforce training evidence without another system that touches a medical record.
Read more →Critical Infrastructure & Energy
Zero footprint on OT — email and human-layer testing only, never a foothold in your control-system network.
Read more →Government & Defense
Built for the audit, not just the click — architected around the CMMC 2.0 / NIST SP 800-171 control families.
Read more →Compliance & framework mapping
SOC 2, HIPAA/HITRUST, CMMC 2.0 / NIST SP 800-171, NIST CSF 2.0, NERC CIP-004-6, PCI DSS 4.0, and GLBA/FTC Safeguards — framework by framework.
View compliance mapping →Interactive playground
Run the exact organizational-risk formula our reports use, and click through a simulated inbox to see the telemetry it generates.
Open the playground →Ready to see it against your own domain?
We'll walk through the architecture, the audit trail, and exactly what your security team would see in week one.
Request a briefing