The four-stage cycle
A repeatable monthly process that proves your clients are testing their people and documenting the results.
One cycle, four stages
A disciplined method that turns testing into a monthly habit.
Test
We test where your client's people actually stand today.
Identify
We identify exactly which employees or departments carry real risk.
Remediate
We assign training that addresses the specific gap the drill exposed.
Retest
We run the simulation again to prove the risk is decreasing.
Know where your client's people actually stand
We run a controlled phishing simulation against the entire organization. The result is a clear, documented starting point.
Initial simulation
A realistic phishing email sent to every employee without warning or preparation.
Risk report
A written deliverable showing open rates, click rates, and credential submissions by department.
Find the risk
We analyze results to see which roles, departments, or individuals actually clicked or submitted credentials.
Vulnerability breakdown
A written deliverable that names the specific people and teams carrying real risk.
Not a score
You get a precise list of who needs attention, not a vague pass/fail number.
Training that addresses the exact gap exposed
We assign focused training to the people who need it most. No one sits through generic security videos.
Targeted assignment
Each at-risk employee receives training specific to the failure we observed.
Documented delivery
A written record of who was assigned training and what they completed.
Prove the risk is actually decreasing
We run the simulation again on your schedule. The comparison report shows the insurer and the auditor that the problem is being managed.
On-demand simulation
Before and after comparison
Documented risk reduction
A monthly habit, not a one-time drill
The cycle runs continuously. Every month brings a new simulation and updated documentation your clients can file away.
Initial risk report
A documented starting point showing exactly where your client's people stand today.
Vulnerability breakdown
A precise list of which employees and departments carry real risk, not a vague score.
Training assignment
A written record of who was assigned training and what they completed.
Comparison report
A before and after deliverable proving the risk is decreasing over time.
Fully managed, nothing to install
Simulations run through GoPhish or Microsoft Attack Simulator. A security analyst handles everything from setup to reporting.
GoPhish
A proven open-source platform for controlled phishing simulations, managed entirely by NopTrace.
Microsoft
We use Microsoft Attack Simulator when your client already has Defender or E5 licensing.
See the cycle in action
Book a call to see how the four-stage cycle fits your SMB clients. We will walk through the process and the documentation.