# Find out who'd click, before someone outside your company does.

> Most phishing-simulation platforms assume you're buying for hundreds of seats and talking to a salesperson first. Small teams are targeted by real phishing precisely because attackers assume nobody's tested them - that gap is exactly what this is for.

## Why it matters at small-team scale

One person clicking one convincing link is still the single most common way a company gets breached, and company size doesn't change that - it just changes how much you've tested for it. A simulated campaign tells you, with real numbers, who opened and who clicked, before it costs you anything.

## How a simulation actually works here

You launch a campaign using a realistic template - a password reset, an invoice, a shared-document notice. It goes to the people you choose, tracks opens and clicks with a safe tracking pixel, and nothing in the message can actually harm anyone who clicks. Afterward you get a clear per-person result, not just an aggregate score.

## What's bundled alongside it

A phishing simulation only tells you about people. The same mail-security tools also cover the domain side: a [DMARC/SPF/MX check](/tools/dmarc-checker) for your own domain, lookalike-domain detection for domains impersonating you, and a header analyzer for a suspicious message someone forwards you. It's the same underlying problem - people and domains both getting impersonated - covered from both directions.

## Questions

**Is it safe to run on real employees?**
Yes. The simulated messages can't deliver malware or collect real credentials - they only track whether a message was opened or a link was clicked, for reporting.

**Do employees know ahead of time that it's a test?**
That's your call, but telling people in advance defeats the point - a real phishing email doesn't warn anyone first. Most teams run it unannounced, then share the results afterward as training, not punishment.

**How is this different from an enterprise platform like KnowBe4?**
It's sized and priced for a small team rather than a seat-count enterprise contract, and it's bundled with the rest of mail security (DMARC, domain monitoring) rather than sold as a standalone training product.

Tool: [See the mail-security tools](https://www.emcheq.com/mail-security)