🛡️ Pentest from €539 · Compliance from €89. See All Services →
Optimum Web
Multi-FrameworkISO 27001SOC 2PCI DSSCR-CROSS-06

Security Awareness Phishing Simulation

Controlled phishing simulation: 3 waves of escalating difficulty, real-time tracking, department analytics, awareness training. Covers NIS2, ISO, SOC, PCI. €229.

Security Awareness Phishing Simulation by Optimum Web is a fixed-price compliance service covering Multi-framework: NIS2, ISO, SOC 2, PCI DSS. It costs €229 with 5–7 business days delivery by senior security engineers. 3-wave phishing campaign (generic → targeted → spear-phishing). 14-day warranty included.

€229
Fixed price, VAT excluded
5–7 business daysSenior only
3-wave phishing campaign (generic → targeted → spear-phishing)
Real-time tracking dashboard: clicks, credential entries, reports
Post-campaign report with department-level analytics
15-minute security awareness presentation for high-risk groups
🛡️
14-Day Warranty
If the delivered pack does not match your ISMS scope and Statement of Applicability, we rework it at no cost, or refund in full within 14 days of delivery.

Secured by PayPal · 256-bit SSL encryption

or order without payment
+373 22 843569
PayPal · SSL
👨‍💻 Senior only
14-day warranty
🆔 CR-CROSS-06

This Service Covers

NIS2Article 21(2)(g) — Basic cyber hygiene and training
ISO 27001Annex A 6.3 — Information security awareness, education and training
SOC 2CC1.4 — Attraction, development and retention (security awareness)
PCI DSSRequirement 12 — Security awareness program

What You Get

Controlled phishing simulation campaign for your employees: we send realistic phishing emails (customized for your industry and company), track who clicks, who enters credentials, and who reports the email. Includes: pre-campaign baseline measurement, 3 waves of escalating complexity (generic → targeted → spear-phishing), real-time tracking dashboard, post-campaign report with department-level analytics, and 15-minute awareness training presentation for high-risk groups.

Who Needs This

  • Companies subject to NIS2 requiring cyber hygiene training evidence
  • Organizations that have never tested employees against phishing
  • Businesses where phishing is the #1 security risk (it usually is)
  • Companies pursuing SOC 2 or PCI DSS needing security awareness evidence

How It Works

  1. 1
    Setup

    Whitelist our sending domain, customize phishing templates for your industry

  2. 2
    Wave 1

    Generic phishing (fake delivery notification, password reset) — baseline measurement

  3. 3
    Wave 2 & 3

    Targeted and spear-phishing (mimicking your vendors, CEO, IT team)

  4. 4
    Report

    Analytics report + awareness training for groups with highest click rates

SAVE 40–50%

Need Compliance Across Multiple Frameworks?

Our Multi-Framework Assessment (€639) covers GDPR + NIS2 + ISO 27001 + SOC 2 in one engagement — saving 40–50% compared to separate assessments.

Multi-Framework Assessment — €639

Ready to Start?

€229 · 5–7 business days · 14-day warranty

+373 22 843569

Secured by PayPal · 256-bit SSL encryption

or order without payment

Need a full compliance assessment? Multi-Framework Assessment — €639

Learn more
Read verified client reviews on Clutch →

Frequently Asked Questions

Will employees know it's a simulation?+
No — that's the point. The simulation must be realistic to measure actual risk. After the campaign, affected employees receive immediate educational feedback explaining what they should have noticed.
What kind of phishing emails do you send?+
Wave 1: generic (delivery notification, password reset). Wave 2: targeted (fake vendor invoice, IT support request). Wave 3: spear-phishing (personalized emails mimicking known contacts). Complexity escalates to measure awareness at each level.
How many employees can be included?+
Up to 200 employees for the standard price. Larger organizations can be accommodated at €1/employee above 200. We recommend including everyone — not just technical staff.
Will this get us in trouble with employees?+
Phishing simulations are standard industry practice. We recommend informing employees beforehand that security awareness testing may occur (without specifics). The post-campaign feedback is educational, not punitive.
How often should phishing simulations be run?+
Quarterly is ideal. The first campaign sets the baseline; subsequent campaigns measure improvement. NIS2 and PCI DSS expect ongoing awareness programs, not one-time tests.

Service page last reviewed 11 August 2026 by the Optimum Web compliance team.

Also Relevant

NIS2

Vulnerability Management Program Setup

€359 · 5–7 business days
NIS2

Risk Analysis & Information Security Policy

€449 · 7–10 business days
+373 22 843569

Secured by PayPal · 256-bit SSL encryption

or order without payment
📞Call Us💬Get Free Quote