PhishMe: Phishing Awareness Training & Threat Simulations for Employees


Users Are NOT the Weakest Link. Let’s bust that myth right now. 100% of the phish Cofense finds in customers’ environments were reported by users. 0% were stopped by perimeter technology. When secure email gateways fail, users are your last line of defense. Will they fall for a phish or report it? Phishing awareness training educates them on the real attacks your company faces, transforming vulnerable targets into active defenders.

Change User Behavior

Cofense PhishMe simulates active phishing threats to condition smarter user behavior. It’s the opposite of “phish testing,” which assesses vulnerability but fails to change behavior through continual learning. Unlike machines, humans can’t be patched. People remain aware of threats through phishing awareness training, practicing regularly, and remaining invested in organizational defense.

Employees need to know how to respond to a phishing email and report it immediately so internal security teams can prioritize, analyze, and act on it fast.

Help Stop Active Threats

Because threat actors constantly innovate, Cofense offers simulations based on their latest tactics. Our simulations are shaped by our deep threat intelligence gathered from the millions of real phishing threats analyzed by the Cofense Phishing Defense Center™, Cofense Intelligence™, and Cofense Labs. Our Active Threat scenarios create the most relevant learning moments. Plus, our new SEG Misses filter lets you deploy phishing scenarios that have bypassed perimeter solutions, similar to those deployed at your organization.

Efficiently manage your phishing awareness training with PhishMe’s Playbook Enrollment

Manage Your Phishing Awareness Training Program Efficiently

Cofense PhishMe Playbooks let you configure a full 12-month program—phishing simulation scenarios, landing pages, attachments, and educational content—in just a few clicks. Our Smart Suggest capability uses advanced algorithms and embedded best practices to recommend scenarios based on current active threats, industry relevance, and your program’s history.

Reach and Train More Users

With Cofense PhishMe Responsive Delivery, you can maximize user engagement by sending phishing awareness emails to employees when they are active in email. Responsive Delivery also eliminates whitelisting and helps reach users across multiple shifts and time zones.

Track your phishing training with Cofense Reporter dashboards.

Measure What Matters

Click rate, or susceptibility, is only part of the story. More important are reporting and resiliency rates, the latter being the ratio of people who click to those who report bad emails. Cofense PhishMe comes with Cofense ReporterTM  – our one-click email reporting button— to turn users into active defenders and reliable human sensors. Combine reporting data to understand how users are likely to react in a real attack. Our Board Reports allow your executives to monitor program performance and track the change in resiliency to phishing.

Integration for Continual Reinforcement

Phishing awareness training should never be “one and done” or offered reactively after an incident occurs. Cofense LMSTM complements Cofense PhishMe’s experiential learning and further prepares them for any real threats they may face.

Efficiently manage your phishing awareness training with Cofense LMS.

Why Choose PhishMe For Phishing Simulation?

With over 29 million employees trained in 160 countries, Cofense PhishMe has been proven to reduce the threat of employees falling victim to advanced cyber-attacks by up to 95% – preparing your last line of defense to recognize and resist tricky phishing attempts.

Click Only: A phishing email that urges the recipient to click on an embedded link.

Data Entry: A phishing email with a link to a customized landing page that entices users to enter sensitive information.

Attachment-based: A phishing email with seemingly legitimate attachments in a variety of file formats.

Double Barrel: Patented technology that simulates conversational phishing techniques by sending two emails – one benign and one containing a malicious element – to train users on this tactic used by APT groups.

Benchmarking: A patented feature to conduct an identical scenario and receive an additional report that provides an anonymous comparison of your results with other Cofense customers or industry peers that ran the same scenario.

Highly Personalized: Simulate advanced social engineering tactics by using specific public, known details about email recipients gathered from internal and public sources.

Sign Up for a Demo Now!

Teach users to identify real phish. Discover how Cofense PhishMe educates users on the real phishing tactics your company faces.

Learn More About Phishing Awareness Training

Phishing awareness is more than being aware of what a phishing email may look like. Employees need to understand the different types of phishing, how attacks can be engineered, and the consequences of clicking on a malicious link, responding to an email with the requested information or opening a file.

Phishing training for employees is one of the most effective ways to strengthen your company´s defenses against malware, ransomware, data loss, and Business Email Compromise (BEC) attacks.

Moreover, when your users report threats, your company can receive reciprocal information about phishing attacks found elsewhere. Such information can be delivered in Machine-Readable Threat Intelligence (MRTI) format, so it can be fed directly into existing security mechanisms (i.e. malicious URL detection systems), which update your technically driven online defenses against malware, data loss, and ransomware attacks.

Monitoring the results of phishing training not only identifies employees who need further training but those who are reliable detectors of phishing. Post-training, many employees will report more potential threats to security teams. Reports from reliable detectors help security teams prioritize reports of possible phishing and respond faster.

One of the best ways to raise phishing awareness is to send simulated phishing emails to employees and stage attacks. Spear phishing and BEC attacks can be highly refined and personal. To make simulation training more impactful, include spear phishing awareness training by crafting messages that are addressed to an individual or specific group. Employ the personal and professional information you have on file to better simulate real phishing attacks that utilize social engineering. Sending a phishing email simulation containing a fake invoice query is simpler but may lack the relevant content that will make it an effective educational tool for every department.

The goals of phishing email simulation should be to build employee confidence, encourage communication, and establish habits that mitigate phishing attacks. Successfully using simulations is just one part of a larger phishing awareness campaign.

A phishing awareness training program can be part of on-boarding, regular training, or done randomly to test the phishing security awareness of individuals or groups. The most effective programs will be thorough and ongoing.

Your phishing training should feature feedback, monitoring, and reporting.

Feedback should go something like this: “Here’s what you did right and here’s what you did wrong,” noting the reasons why. This lets employees and senior management discover both their weaknesses and the areas they need to improve upon.

Using a security awareness LMS allows you to do this at scale.

Other Cofense Solutions


Cofense PhishMe


View Cofense PhishMe Datasheet


Responsive Delivery


View Responsive Delivery Datasheet


Cofense Triage


View Cofense Triage Datasheet


Cofense Vision


View Cofense Vision Datasheet