A realistic phishing simulation should resemble a decision the employee might actually face. A payroll change is relevant to HR. An unfamiliar repository invitation fits an engineering workflow. A supplier's payment request matters to finance. Realism depends on the request, the recipient's responsibilities and the safe action they are expected to take.

This shortlist compares official product capabilities and their suitability for that approach. It contains no hands-on detection scores or measured ranking. The options offer different ways to create, target and adapt simulations; the buyer's task is to establish which can support relevant practice without making the programme difficult to control.

Define a realistic exercise before choosing the platform

Write down the scenario, the employee's role and the behaviour the exercise should reinforce. Include how the person verifies an uncertain request and where they report it.…