The phishing problem · 2025

Your weakest link is already clicking.

The cost of one clickview sources ↓
68%
of breaches involve a human element. Most start with a single phishing email.[1]
1 in 4 employees fail their first phishing test[2]$4.88M avg. cost of a credential-driven breach[3]21 sec median time-to-credential entry, untrained user[1]
mail.acme-corp.com / inbox● UNTRAINED USER
PrimarySocialPromotions
IT
IT Support
Action required: password expiring in 1 hour — Reset to keep account access…
just now
M
Marketing
Q3 campaign results — Numbers are in, hit 118% of pipeline target…
1h
H
HR Department
Updated PTO policy — Please review attached changes for FY26…
1h
JM
John Miller
Re: Project timeline — Looks good. Let's sync tomorrow at 9…
2h
F
Finance
Monthly expense report — Attached for your review and approval…
3h
IT
IT Support <support@acme-corp.io>
to sarah.chen@acme-corp.com · just now
Action required: password expiring in 1 hour

Hi Sarah,

Our security audit detected your password is set to expire in 59 minutes. To avoid losing access to email and Slack, please reset it immediately using the secure portal below.

→ Reset password now

If you don't reset before expiry, your account will be locked and IT will need to manually restore access (typical wait: 4–6 business hours).

— Acme IT · Do not reply · Ticket #SEC-29481

https://acme-corp-secure.co/login
Sign in to renew your password
Email
sarah.chen@acme-corp.com
Password
•••••••

Reported in 9 seconds.

Sarah recognized the sender mismatch, hit Report phish, and the campaign was quarantined for the rest of the org.

9s
Time to report
412
Teammates protected
$0
Breach cost
!
21 SECONDS · NO INTERVENTION

Credentials captured.

+00:00sEmail opened by S. Chen · Sales
+00:08sClick on "Reset password" link
+00:14sLookalike domain loaded · acme-corp-secure.co
+00:21sCredentials submitted · attacker now has account access
+00:23sLogin from 104.21.x.x · Tallinn · session token issued
+00:42sMFA bypassed via session-replay · all 14 systems accessible
Time to compromise
21s
Systems exposed
14
Avg. breach cost
$4.88M
01 · Inbox+00:00s
21s
Median time-to-compromise
$4.88M
Avg. breach cost · IBM 2025
76%
Click-rate drop · 12 weeks
Phish them firstTrain the moment they clickSOC 2 ready in 4 minutes21s to compromisePhish them firstTrain the moment they clickSOC 2 ready in 4 minutes21s to compromise
· the fix
That's them. Now meet us.
Hukproof · 1.7-second campaign

Spin up the same attack — for good.

Type one line. Hukproof writes the lure, sets up the lookalike domain, generates the landing page, and sends to the right people. Then auto-trains everyone who clicks.

Same 21-second timeline. Different ending.

1.7s
to generate a campaign
4 min
to first send
76%
click-rate drop, 12 wks
14
languages supported
hukproof.com / newLIVE
Describe your campaign
Password reset, salesMicrosoft 365 invoiceSlack join requestQR parking pass

Generated lure

acme-corp-secure.co · DKIM aligned · 1.7s
From: IT Support <noreply@acme-corp-secure.co>
Action required: password expiring in 1 hour

We've detected unusual activity on your account. Reset your password within the next hour to maintain access.

Reset password →
PIPELINE · generating5/5
01Lure copy 14 langs
02Lookalike domain DKIM/SPF
03Landing page brand-matched
04Auto-trainer 30s nudge
05Target list SCIM sync
Generated 5 in 1.7s.
Four steps · ~ 4 minutes

Discover. Train. Protect. Repeat.

~ 4 min
setup
01
Discover

Find out who's vulnerable right now.

Hyper-realistic simulations tailored to your industry. See which employees would fall for a real attack — no guessing, real data in 48 hours.

→ At-risk ranked in 48 h
Top 5 at-risk · acme corp
S. Chen · Sales0%
D. Park · Marketing0%
A. Yusuf · HR0%
J. Miller · Finance0%
R. Singh · Eng0%
02
Train

Teach the moment they click.

30-second explainer tailored to the exact lure. The clue that fooled them, highlighted. No videos, no quizzes, no LMS logins.

0× retention
SIMULATED
You almost got phished.

The sender domain doesn't match your company's. Look closer next time.

→ acme-corp-secure.co vs. acme-corp.com
03
Protect

Track click ↓ and report ↑.

Live dashboard of click rate, report rate, time-to-report. Board-ready PDF mapped to SOC 2 controls CC6.8 + CC7.2.

→ Click rate falls every campaign
CLICK ↓ · REPORT ↑per campaign
C1C2C3C4
04
Improve

Sharpen with every campaign.

Hukproof updates templates, re-targets vulnerable employees, and tracks department progress until habits form.

→ ↓ 0% click rate, 12 wks
CLICK RATE · 12 WK0%
0.0%from 17%
Features · 6 chapters

Everything a security consultant would build you. Without hiring one.

06 / 06
01AI generatorBeta

Lures, auto-generated for your industry.

Tell Hukproof your stack. It writes templates that mirror today's live attacks — Slack, DocuSign, Vercel, internal IT.

Stripe payout holdfintech · L4
Slack join requestsaas · L3
DocuSign contractlegal · L2
IT password resetuniversal · L1
02ChannelsEmail + QR

Test every vector. Not just email.

Email, QR code (printed posters, conference badges), and SMS smishing — all in one platform.

EMAIL
QR
SMS
03RiskLive

Department risk scores, live.

Find the 8 people behind 80% of clicks. Repeat-offender flagging built in.

Sales
72
Marketing
58
HR
45
Finance
34
Eng
22
04DomainPro

Send from a branded domain.

SPF, DKIM, DMARC handled. Pool of 30+ pre-warmed domains, per-campaign rotation.

https://it-support.acme-corp.io
SPFDKIMDMARC
05Trainer30s

Teach the moment they click.

Land on a 30-second explainer tailored to the exact lure. No videos. No LMS. Annotated screenshot with red-flags.

SIMULATED
You almost got phished.

This sender's domain doesn't match your company's.

→ company-secure.co vs. company.com
06ReportSOC 2

The dashboard your board wants.

One-page PDF per campaign: click, credential entry, time-to-report, department leaderboard. SOC 2 mapping included.

Sent
100%
Opened
62%
Clicked
34%
Entered
18%
Reported
48%
Cost calculator

What you'd save vs. the old guard.

Your team.

Slide to match. Comparison updates in real time.

Seats250
Avg. salary$95k
Hours per training / yr4 h
Current click rate17%
Estimated annual savings with Hukproof
$184,200/ year

Versus KnowBe4 on platform fees alone. Add productivity recovered and risk reduction below.

Vendor list pricing as of May 2026 · breach probability modeled on Verizon DBIR 2025 click-to-credential rate · figures are illustrative.
Pricing

Cheaper than one security consultant call.

Annual billing
save 20%
Free
$0/mo

Run unlimited campaigns for teams up to 25.

  • Up to 25 seats
  • Unlimited email campaigns
  • 50 starter templates
  • Basic risk dashboard
Start free
Startup MOST PICKED
$2/seat / mo

Everything a Series A needs for SOC 2 controls CC6.8 + CC7.2.

  • Unlimited seats
  • AI campaign generator
  • Email + QR + SMS engine
  • Custom branded domain
  • SOC 2 audit-ready exports
  • Email support · 1 business day
Start 14-day trial
Scale
Custom

For 500+ seats, multi-tenant, or regulated industries.

  • Everything in Startup
  • SAML SSO + SCIM
  • Custom phishing domain pool
  • Dedicated success manager
  • Audit log + DPA + BAA
Talk to sales
H
Ready when you are

Phish your team in 4 minutes.

Free for teams up to 25. No card, no sales call, no SOW. We'll show you exactly who would have clicked.

Sources & methodology
  1. Verizon Data Breach Investigations Report (DBIR), 2025. 68% human-element finding, p. 8. verizon.com/dbir
  2. Proofpoint State of the Phish, 2024. First-test failure rate across 7,500 SMB users. proofpoint.com
  3. IBM Cost of a Data Breach Report, 2024. $4.88M global average; phishing as initial vector adds 19 days dwell. ibm.com/reports/data-breach
  4. Hukproof internal benchmarks, 2024–25. 11,420 simulated campaigns across 318 startup customers. Anonymized aggregate data, available on request.