HookPhish

BACKGROUND

Introduce your business and what you do there.

I'm the head of security of an organization that helps companies identify, test, and improve their cybersecurity posture through continuous security testing and risk assessment.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with HookPhish?

We needed help testing our real-world phishing resilience, improving employee security awareness, and gaining better visibility into potential exposure through phishing, data breaches, and look-alike domains.

SOLUTION

What was the scope of their involvement?

HookPhish handled the setup and execution of phishing simulation campaigns, provided security awareness training for our team, and delivered detailed reporting on user behavior and risk levels. The scope also included data breach monitoring and typosquatting detection, giving us broader visibility into external threats beyond email phishing.In terms of tools, HookPhish provided a centralized platform to manage phishing simulations, user groups, and training, along with clear dashboards and reports showing email delivery, open rates, click rates, and credential submissions. They also delivered monitoring outputs for data breaches and typosquatted domains, which helped us track external risks and take action quickly.

What is the team composition?

We worked with an unknown number of teammates from HookPhish.

How did you come to work with HookPhish?

We found them through an online search. We chose them because they were close to our geographic location, and their pricing fit our budget.

How much have you invested with them?

We spent less than $10,000.

What is the status of this engagement?

We worked together in January 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We saw a noticeable reduction in phishing click rates over time, improved employee awareness during follow-up simulations, and clearer visibility into external risks through breach monitoring and typosquatting alerts. The reporting also made it easier to track progress and demonstrate security improvements internally.After running multiple simulation cycles with HookPhish, we reduced phishing click rates by around 35%–40% compared to our initial baseline, and the number of users reporting suspicious emails increased by over 50%. These results showed a clear improvement in awareness and safer user behavior over time.Moreover, the interactive dashboards and detailed campaign reports were especially useful. They allowed us to track individual and team-level behavior over time, highlight reductions in click rates, and show improvements in suspicious email reporting. The data breach and typosquatting alerts were also valuable, giving stakeholders clear visibility into external risks and reinforcing the importance of our security initiatives.

How did HookPhish perform from a project management standpoint?

HookPhish's project management was very organized and responsive. Campaigns, training modules, and reports were delivered on time, and their team communicated clearly throughout the process, making it easy for us to stay on schedule and coordinate internally.We mainly communicated through virtual meetings, emails, and messaging apps.

What did you find most impressive about them?

What stood out most was how realistic and actionable their phishing simulations were, combined with their comprehensive visibility into external risks like data breaches and typosquatting. Unlike other platforms, HookPhish made it easy to see measurable improvements in employee behavior while giving us practical insights to strengthen overall cybersecurity.

Are there any areas they could improve?

Overall, the experience was very positive, but one area for improvement could be providing more customizable training content tailored to different departments or roles. While the existing modules were effective, having role-specific examples could make the training even more engaging and relevant.