Test your people with your real attacks.
Aegis replays phishing it caught in your tenant to the people it targeted, and separates human clicks from scanner clicks.
security teams at:
Your click rate measures the template and the scanner.
Link scanners open messages before anyone does, and library lures are easy to spot. The number the board sees is not about your people.
failure rates across different lures in one organization. The template decided the result.
Ho et al., IEEE Symposium on Security and Privacy 2025One real attack becomes one safe test. Watch it happen.
A phishing email Aegis caught for six people in Finance, replayed to the same six people and scored.
- CaughtAug 12
- Made safeBefore sending
- SentAug 26
- ScoredAug 26
- TrainedAug 26
To: 6 people in Finance
Your Q3 statement is ready to review
Your quarterly statement is available. Sign in to view it before it expires.
Link: office-signin.example.top- Link
office-signin.example.top→ a safe training page - Sender
docs-example-share.com→ a simulation sender - WordingKept word for word: the same lure
- PeopleThe same 6 people it was aimed at
- Priya NairDelivered
- Tom BeckerDelivered
- Ana SouzaDelivered
- Leo GrantDelivered
- Mia ChenDelivered
- Sam OrtizDelivered
Opened within a second. Left out.
Without clicking: the best outcome
Goes straight to training
The score counts what people did. Link scanners are filtered out first.
- Saw that it was a simulationright after the click
- Watched the training videomatched to this attack
- Took the quizscore recorded
From a real attack to a trained person. Pick a step to see it.
Your Q3 statement is ready to review. Sign in to view it before it expires.
- LureWord for word the email Aegis caught on Aug 12
- LinkThe fake sign-in page is swapped for a safe training page
- PeopleThe same 6 people, matched from Entra ID
6 clicks within a second of deliveryLink scanner, left out- 4 people reported it without clickingCounted
- 1 person clicked the linkCounted
This was a simulation, built from a real attack sent to your team.
- NoticeShown right after the click
- TrainingA short video, matched to credential phishing
- QuizTaken after the video, score recorded
- Reported without clicking4 people
- Clicked, then completed training1 person
- Link scanner clicks filtered out6 clicks
How Aegis turns a caught attack into a test
Seven agents do the work behind every replay: they make it safe, send it and score it.
What the research says.
Source: Verizon 2025 Data Breach Investigations Report.
What your security team will ask
Can we replay an attack to the people it targeted?
Yes. Caught phishing is sanitized and sent back to the people it was aimed at, with a safe training page as the payload.
How do you handle scanner clicks?
Scanner and bot clicks are separated from human clicks before scoring.
Is training mandatory after a click?
It is configurable per campaign.
Can we keep our KnowBe4 history?
Yes. Campaign history is loaded and charted, so trends continue.
Replay your own attacks.
Simulations run on the connection detection already uses, targeted from your identity provider.
See what Aegis finds in your environment.
Connect a tenant, run in monitoring mode, and compare against what your current stack delivered.