No passwords stored
Simulated sign-in pages record that a password was typed, never what it was.
Security training · Attack simulation
Practise against real attacks, safely.
Realistic phishing, smishing, vishing, QR-code, MFA-fatigue and deepfake simulations, sent at rising difficulty and followed by an instant lesson. Try one just below: open each message, click anything suspicious, then report it or keep it.
Try it now
Your inbox has four new messages
Some are genuine and some are simulated attacks. Open each, click anything that looks wrong, then report it or keep it.
Threat radar
Twelve attacks across six channels
Each blip is an attack your people will face. The further out, the harder it is to spot. Select one, or filter by channel.
Campaign builder
From idea to running campaign in six choices
Every choice has a sensible default, so a first campaign takes minutes. Watch one being set up.
AudienceFinance team · 18 people
✓AttackInvoice fraud · BEC
✓DifficultyLevel 3 · department-specific
✓Sending windowRandom times over 5 working days
✓On click60-second teachable moment
✓Follow-upClickers enrolled in Payment Fraud Essentials
✓Launch campaign
Preview · what Finance will receive
Accounts · Arihant Infotechbilling@arihant-infotech.co
Please note our bank details have changed. Kindly settle invoice INV-2291 to the new account before Friday to avoid a late fee.
INV-2291.pdfSent18
Reported12
Clicked2
The teachable moment
The best time to learn is right after a mistake
When someone clicks a simulated link or enters a password, they land on a short page that shows exactly which red flags they missed, on the message they just saw. No shame, no lecture: sixty seconds, then back to work.
- The real message, annotated with its red flags
- One question to confirm the lesson landed
- A follow-up lesson assigned only if needed
learn.complilens.app/moment/8f2c
This was a CompliLens simulationNo harm done
You entered your password on a page that looked like our sign-in. Here is what gave it away:
1The sender was northwind-helpdesk.co, not northwind.com
2It demanded action within two hours
3The page address was not our sign-in domain
Got it, take the 1-minute checkReport button
Every report makes the whole company safer
One click in Outlook or Gmail. Simulations are confirmed instantly. Real threats become incidents in CompliLens, with the reporting clocks already running.
Difficulty
Five levels, raised as people improve
The same goal at every level: get someone to act without checking. What changes is how convincing it looks. CompliLens raises each person's level once they consistently report.
Level 1Generic lure
From: Microsoft TeamYour mailbox is full!!! Click here
Obvious spelling and a generic senderLevel 2Brand look-alike
From: DocuSignNorthwind sent you a document to review
Believable brand, believable timingLevel 3Department-specific
From: Arihant Infotech billingUpdated bank details for INV-2291
Targets Finance with a real supplier nameLevel 4Personalised
From: Rohan MehtaAisha, quick review of the Q3 board deck?
Uses the person's name, manager and projectLevel 5Multi-step
Email, then a phone call“Did you get my email? I need it approved now.”
A follow-up call makes the email feel realSafe by design
Realistic for staff, safe for the business
Allowlisted delivery
Messages reach inboxes reliably without weakening your mail filters.
Quiet periods
Pause simulations during payroll runs, incidents or holidays.
Fair to people
No public leaderboards of mistakes. Coaching is private, and reporting is rewarded.
Questions
Simulation, answered
Will simulations disrupt real work?
Campaigns send at random times within a window you set, pause during quiet periods and never touch real accounts. Most people spend under a minute on a teachable moment.
Do you store the passwords people type?
No. A simulated page records only that a password was entered, so the person can be coached.
Can we simulate voice and deepfake attacks?
Yes. Vishing and cloned-voice scenarios are available for teams that handle payments or sensitive requests, with consent and clear rules.
What happens when someone reports a real phish?
It opens an incident in CompliLens, with CERT-In, GDPR and any other applicable reporting clocks, and links to the person who reported it.
Keep exploring