Phishing Campaigns

Reconnaissance to identify targets and the pretexts most likely to land, multi-wave phishing emails delivered from a custom Gophish instance integrated with Evilginx that mimic trusted providers, credential capture, malicious attachment and MFA-bypass scenarios that capture session tokens, and simulated lateral movement when an attempt succeeds to show how far an attacker could advance. The report covers click rates, credential submission, report rates and the effectiveness of your email security controls.

There is no list price, because cost is driven by tester time rather than by mailbox count. The variables are the number of waves, how much bespoke pretext development each wave requires, whether MFA-bypass scenarios are in scope, and the number of languages and jurisdictions. For reference, CISA offers a no-cost Phishing Vulnerability Scanning service under its Cyber Hygiene program, and Microsoft lists Defender for Office 365 Plan 2 with attack simulation training at US$5.00 per user per month paid yearly. Stingrai quotes tester-run campaigns per engagement.

A campaign runs in waves, and each wave needs reconnaissance, pretext development and approval, sending, and a measurement window long enough to capture late clicks and reports. Single-wave baselines are the shortest engagements; multi-wave campaigns with MFA-bypass scenarios and lateral movement run longer. We agree the wave plan and measurement windows at scoping, and continuous programs repeat waves on a schedule so you can track whether the human layer is improving.

There is no universal good number, because click rate moves with the difficulty of the lure rather than the competence of the staff, which is why NIST built the Phish Scale and warns that click rates analyzed on their own can create a false sense of security. Judge a campaign on credential submission rate, MFA-bypass susceptibility, reporting rate and time to first report. Verizon's Data Breach Investigations Report puts median time-to-click at 21 seconds against median time-to-report at 28 minutes.

No framework mandates a simulated attack. PCI DSS v4.0.1 Requirement 12.6.3.1 requires that security awareness training include awareness of phishing and social engineering, SOC 2 criterion CC2.2 covers internal communication of security responsibilities, and ISO/IEC 27001:2022 Annex A 6.3 covers awareness, education and training. A phishing assessment produces operating evidence that those controls work under adversarial conditions, which supports the evidence your auditor requests.

Take a one-time baseline first, then move to a recurring program once someone owns the gateway, identity and service-desk changes the baseline surfaces. Quarterly waves are a common cadence because they give enough time for training and control changes to show up in the reporting rate. Stingrai delivers both one-time campaigns and continuous programs, and each campaign ends with a structured training plan designed to reduce susceptibility over time.

Stingrai runs tester-led campaigns rather than a self-service platform: our penetration testers research your organization, build bespoke pretexts, and use a custom Gophish and Evilginx stack that captures session tokens and bypasses multi-factor authentication, then simulate lateral movement to show the real blast radius. We report a reporting rate and a detection timeline rather than click rate alone, and we are a CREST-accredited penetration testing service provider founded in 2021 with offices in Toronto and London.