The four-stage cycle
A repeatable quarterly process that proves your people are being tested and the results are documented.
One cycle, four stages
A disciplined method that turns testing into a quarterly habit.
Test
We test where your people actually stand today.
Identify
We identify exactly which employees or departments carry real risk.
Remediate
We assign training that addresses the specific gap the drill exposed.
Retest
We run the simulation again to prove the risk is decreasing.
Know where your people actually stand
We run a controlled phishing simulation across the whole organisation. The result is a clear, documented starting point.
Initial simulation
A realistic phishing email sent to every employee without warning or preparation.
Risk report
A written deliverable showing open rates, click rates, and credential submissions by department.
Find the risk
We analyse results to see which roles, departments, or individuals actually clicked or submitted credentials.
Vulnerability breakdown
A written deliverable that names the specific people and teams carrying real risk.
Not a score
You get a precise list of who needs attention, not a vague pass/fail number.
Training that addresses the exact gap exposed
We assign focused training to the people who need it most. No one sits through generic security videos.
Targeted assignment
Each at-risk employee receives training specific to the failure observed.
Documented delivery
A written record of who was assigned training and what they completed.
Prove the risk is actually decreasing
We run the simulation again on your schedule. The comparison report shows an insurer or auditor that the problem is being managed.
On-demand simulation
Before and after comparison
Documented risk reduction
A quarterly habit, not a one-time drill
The cycle runs continuously. Every quarter brings a new simulation and updated documentation you can file away.
Initial risk report
A documented starting point showing exactly where your people stand today.
Vulnerability breakdown
A precise list of which employees and departments carry real risk, not a vague score.
Training assignment
A written record of who was assigned training and what they completed.
Comparison report
A before and after deliverable proving the risk is decreasing over time.
Fully managed, nothing to install
Simulations run through GoPhish or Microsoft Attack Simulator. We handle everything from setup to reporting.
GoPhish
A proven open-source platform for controlled phishing simulations, managed entirely by NopTrace.
Microsoft
We use Microsoft Attack Simulator when you already have Defender or E5 licensing.
See the cycle in action
Book a call to see how the four-stage cycle would fit your business. We will walk you through the process and the documentation.