Security Awareness Training That Actually Works

An admin creates an organization, invites employees by email or bulk CSV, and manages everything from a centralized dashboard. Employees receive simulations on their own cadence; the admin sees aggregate analytics, department breakdowns, training progress, and audit-ready reports across the entire team.

When you activate an org plan (trial or paid), ScamDrill automatically runs a baseline: every employee gets two intermediate-difficulty email drills over the first seven days, with the adaptive engine and tactic-targeting switched off so the measurement is clean. About 48 hours after the last baseline drill you get a results page — click rate, report rate, per-tactic breakdown, and how you compare with the typical first two weeks of other ScamDrill organizations — plus a printable one-pager for your boss or board. We email you when it’s ready. Then Autopilot takes over.

Autopilot is on by default for every org plan. You choose a cadence — monthly, every two weeks (the cadence most security reviewers recommend), or weekly — and ScamDrill handles the rest: each employee gets drills on that schedule at a difficulty tuned to their own track record, anyone who clicks is assigned a two-minute lesson on the exact persuasion tactic that got them, they’re quietly re-tested on that tactic one to three weeks later, and the admins you list receive a monthly report by email. New employees inherit the cadence automatically. Campaign-level controls (hand-picked templates, department targeting) remain available on Business and Enterprise for teams that want them.

Detect → diagnose → assign → deliver → verify. When an employee clicks a simulated link, the debrief page they land on already offers the lesson for the tactic that worked on them (authority, urgency, scarcity, fear, social proof, reciprocity, commitment, or liking). If they don’t start it, they get a reminder email the next day and one more nudge two days later; lessons expire after a week rather than nagging forever. Each lesson is two to four minutes with a three-question check. Completing it schedules a re-test: their next drill carrying that same tactic arrives 7–21 days later, and reporting it closes the loop. The same lesson is never assigned twice within 30 days, and a repeat slip on the same tactic within 90 days is flagged as escalated in the webhook event — nobody’s manager is ever notified automatically. Ignoring a drill is not a failure and never triggers a lesson.

Yes. Employees forward a suspicious email to report@scamdrill.com from any mail client — Outlook, Gmail, Apple Mail, mobile — with nothing to install. If it was a ScamDrill drill they get credit immediately. If it was a real phishing email, it’s recorded as a caught threat, and on Business and Enterprise plans the employee receives the same AI risk verdict as check@scamdrill.com, framed as a thank-you rather than a scam check. A native Outlook add-in (task-pane button, deployed from the Microsoft 365 admin center) is in development.

Publicly and with the method written down. For each customer organization we compare click rate in its first four weeks of activity with weeks 9–12, counting only organizations with enough sends and active employees in both windows, and we report the median relative change with the interquartile range across at least ten organizations. Internal and test accounts are excluded. The number is computed monthly and only appears on this page once it clears that bar; until then we show nothing rather than a cherry-picked figure. Your own dashboard shows your organization’s trend from day one.

Yes — a one-time setup so simulated phishing lands in inboxes the way real phishing would, instead of getting flagged by your gateway. Our guided Email Delivery wizard walks your IT admin through a few clicks in Microsoft 365, Google Workspace, or your provider of choice. No DNS changes required to get started.

Yes, optionally. By default, simulations come from third-party lookalike domains we own — DHL-style shipping notices, DocuSign-style signature requests, and so on — which mirror real external phishing. For higher-realism internal pretexts (CEO BEC, IT helpdesk, payroll), your admin can pre-approve your own domain in the Email Delivery wizard, and those campaigns will land with your real domain in the From: header. Both modes use an explicit consent click and a full audit log of which sender domains you've authorized.

Realistic enough that click rates on first-month simulations typically match what attackers see in the wild — that's the point. Templates cover the highest-volume real-world pretexts (shipping notifications, document-share requests, Microsoft 365 admin alerts, voicemail notifications, invoice fraud, IT helpdesk tickets, payroll updates, CEO wire-transfer requests). Each simulation pairs a brand-correct visual layout with a sender domain that matches the pretext, and the educational debrief shown after a click teaches the specific red flags that template exercised.

Yes. Organize employees into departments and run targeted training campaigns that send specific simulation templates on a schedule. For example, you can run BEC pretexts for Finance, credential-harvesting campaigns for Engineering, and HR-themed lures for everyone during open enrollment.

Forward any suspicious email to check@scamdrill.com and receive an instant AI-powered analysis: sender authentication, content-pattern review, and link inspection — returning a risk score, red flags, and recommended actions within seconds. Included with Business and Enterprise organization plans.

Every org plan — Starter, Team, Business, and Enterprise — includes audit-ready reports with employee-level detail: simulation delivery records, click and report rates, risk scores, and annual web-based-training completion. Reports export to CSV for SOC 2, ISO 27001, HIPAA, PCI-DSS, and other frameworks. Custom date ranges are supported, and Enterprise+ customers can pull the same data via the REST API.

The Enterprise plan includes a REST API plus webhook events for real-time campaign activity (sent, opened, clicked, reported), remediation lifecycle events (assigned, completed, resolved), and real threats reported by employees. SAML SSO and SCIM directory sync via WorkOS are available as an add-on — works with Okta, Entra ID (Azure AD), Google Workspace, OneLogin, JumpCloud, and any SAML 2.0 IdP, so deprovisioning a user from your IdP automatically deactivates them in ScamDrill.

Yes, on the Enterprise plan. Customize primary and secondary colors, sender display names, and email footers across all training and notification mail. Full white-label mode removes ScamDrill branding entirely so simulations and report emails appear as internal training from your security team.