Resources, research and the 2026 Index
What we’ve learned, in writing.
Free to read. Free to cite.
We publish what we learn, because the human-risk category will only get good if everyone working on it can see the data.
Special edition · Out now
The 2026 SimuPhish AI Phishing Index.
4.7 million simulated lures across 12 sectors, 31 markets and 7 channels. The largest behavioural dataset on AI-driven phishing ever published. Free to read. Free to cite.
Index 2026 · Issue 04Voice deepfakes overtook email.
The fastest-growing attack vector in MENA finance, up 418% year-on-year.
4.7M
lures simulated
12
sectors
31
markets
Five featured chapters · Free to read
NewReading list
For security buyers, not security tourists.
The 2026 SimuPhish AI Phishing Index
4.7M lures, 12 sectors, 31 markets. The largest behavioural dataset on AI-driven phishing ever published.
ReadDefending against voice deepfakes, the CISO's six-step playbook
Why vishing is the fastest-growing attack vector in MENA finance, and what a defensible response actually looks like.
ReadMapping SimuPhish to SAMA, NCA, DORA, and the UAE NESA framework
A clean-sheet mapping document used by twelve regulated customers in their last audit cycle.
ReadWhat we learned shipping Arabic-native phishing simulation
The cultural patterns, dialect splits, and identity-graph quirks that determine whether a localised lure actually lands.
ReadBeyond the click: why hover-time, hesitation, and report-rate matter more
An engineering deep-dive into the SimuHDR scoring model, from raw signals to per-person risk numbers.
ReadHow a national bank cut executive-spoof exposure by 63%, quarter by quarter
An account of one of our most-instrumented engagements, with the actual scoring deltas (anonymised).
ReadCompetitor comparisons
SimuPhish vs the field. Honestly.
Full matrixvs KnowBe4
vs Hoxhunt
vs Adaptive Security
vs Proofpoint Security Awareness
vs Cofense
vs Outthink
vs PhishRod
Ready when you are
The phishing defense your team will actually use.
Two minutes to a quote. One business day to a real reply. No drip sequences. No per-seat list.
