Phishing Campaign

The engagement has five stages. In the kickoff meeting we request the target data, with name, email and job title, along with samples of the company's internal emails, and the necessary technical arrangements are agreed on. BrownPipe then gathers information about the targets and about the company's relationships with external entities. From that, the campaigns are built, partly generic and partly customized, and sent. At the end, a detailed report is delivered and presented in a dedicated meeting. In the full program, or when the workshop is contracted separately, there is also an awareness session with the team.

Because a convincing simulation has to resemble what that company actually receives. The samples show what internal announcements look like, what tone is used, what subjects circulate and how legitimate messages appear. Without them, the campaign becomes a generic fraud email, which measures little because it is far too easy to spot.

Yes, and that is what separates a real simulation from a standardized blast. Starting from the data the company provides, we research the targets and the organization's relationships with suppliers, partners and other external entities. It is the same kind of research an attacker would do before building a targeted fraud, and that is precisely why it reproduces the real threat.

No. Each engagement combines generic campaigns with customized ones built from that research. Their creation also takes into account seasonal events during the contract period, such as high-volume shopping dates and year-end, and the company's internal context, such as ongoing events and communication initiatives. Those are exactly the moments when real fraud increases, and when the simulation measures best.

It depends on the goal. A single campaign gives a snapshot of the moment and works as an initial diagnosis. Changing behavior requires repetition over time, which is why the full program includes eight campaigns. When campaigns are contracted individually, the company decides how many to run.

When campaigns are contracted individually, the company defines how many there will be and the audience for each, and the workshop is contracted separately if desired. The full program includes eight campaigns and the workshop, with detailed audience mapping and campaigns tailored to different segments of the organization, which can go as far as individual approaches. In that arrangement, when the team identifies additional opportunities during the engagement, extra campaigns are run at no additional cost.

Yes. The audience can be the entire organization, specific areas such as human resources or technology, or smaller groups such as executives and managers. In the full program, the mapping allows going down to individual approaches when that makes sense. Defining the audience is part of the contract.

From 20 days, for a single campaign, up to 60 days, for more than four campaigns or for the full program. The timeline covers every stage, from the initial research to the presentation of the report, and not only the sending of the messages.

Yes, and this is a requirement, not an option. The purpose of the service is to test how people behave, not how effective the blocking tools are. If the filter stops the message before it arrives, there is nothing to measure about the team's reaction. The company receives the domains and IP addresses to allow and configures them before the start.

Employees with a direct employment relationship with the contracting company. Contractors, service providers and staff from partner companies are outside the scope, because testing someone who has no relationship with the party that hired us involves a relationship that is not the client's.

A detailed report with the campaigns carried out and the results obtained, presented in a meeting held for that purpose. The presentation exists because a report sent by email tends to be read halfway, and discussing the results with the people who decide is where the work turns into action.

It is a live online session of up to two hours with the team the company designates, which can be the entire staff. In it, the campaigns that were run are detailed, explaining the purpose of each one and teaching how to identify and avoid similar attempts. The session is recorded and the recording remains available to those who could not attend. It is included in the full program and can be contracted separately when campaigns are bought individually.

Because the team has just been through them. Showing the email that circulated at that company, with that company's names and context, and discussing why it worked, has a different effect than presenting an abstract example of fraud. The workshop takes place after the campaigns for precisely that reason.

Punishment is the organization's decision and involves internal policy and areas that are not ours. What we state technically is that the purpose of the work is diagnostic, and that the result serves to guide the training that follows. Someone who clicks on a campaign built with research about the company was not careless; they reacted to a message designed to be convincing. Programs that punish tend to reduce people's willingness to report a real phishing attempt, which is the behavior most worth preserving.