Smishing Simulations

Messages are sent from a platform-owned origination number and delivered through a transactional SMS provider. Delivery is gated to each recipient business hours in their own timezone and spread across a send window to avoid burst patterns and carrier rate limits.

Only employees with a phone number on file can be selected as recipients, and the audience picker shows who is eligible before you launch.

Standard SMS opt-out is built in. A recipient who replies STOP is added to a per-tenant and a platform-wide opt-out registry and is never messaged again, on any campaign. A recipient who replies REPORT is recorded as having taken the correct, secure action.

This keeps your program compliant with carrier rules and respectful of employees who do not want simulated texts.

A phishing simulation tests email; a smishing simulation tests SMS. Both run on the same platform with the same scheduling, targeting, and automated remediation.

The channels differ in ways that matter: SMS has no gateway to scan links, delivery is gated to business hours, opt-out follows carrier STOP rules, and only employees with a phone number can be targeted. To see how the underlying attack works, read the smishing threat guide.

Not as a live campaign channel. Email and SMS campaigns ship today; outbound voice delivery is scaffolded in the platform but deferred to a later release, so we do not sell it as available.

You can train the reflex now with the immersive vishing exercise and the callback-phishing exercise, which drills the text-then-call pattern that pairs with smishing. See how voice phishing works for the attack side.

Yes, when run correctly. Testing your own employees with simulated messages is lawful, but GDPR Article 88 and works-council agreements govern how you monitor staff. The platform supports this with jurisdiction settings, aggregate-only reporting, and standard opt-out handling.

As with any monitoring program, confirm your works-council and privacy obligations before launch in regulated jurisdictions.

Pick the SMS channel, choose an approved template, set a send window, and select recipients. Only employees with a phone number on file are eligible, and the audience picker shows who is in and who is excluded before you launch.

Delivery is held until working hours in each recipient timezone and spread across the window to avoid burst patterns and carrier rate limits. Taps and REPORT replies are tied to a signed, time-limited token, so every interaction maps back to a specific recipient and dispatch.

Messages send from a platform-owned origination number through a transactional SMS provider, with the origination country configurable per tenant so the number looks local to the people receiving it.

Standard carrier opt-out applies to that number: a STOP reply lands in both a per-tenant and a platform-wide registry and stops all future messages.

Yes. A tapped text feeds the same susceptibility signal as a clicked email, so it moves that person’s human risk score and can trigger risk-based automation.

Reporting the text counts the other way. Spotting and flagging a lure is the behavior the score rewards, and it is the metric worth managing over click rate alone.

Often enough that the channel stays in people’s heads, rarely enough that it does not read as harassment. Most programs fold SMS into the existing campaign calendar rather than running it as a separate exercise, so a person sees a mix of channels over a quarter.

Because reporting rate is the headline metric, the useful cadence is whatever lets you see that number move campaign over campaign rather than chasing a single result.