Email Phishing Assessments

Email Phishing: Still the Most Effective Attack Vector

Despite decades of security awareness campaigns, email phishing remains the single most successful method attackers use to gain initial access to organizations. A convincing email — especially a targeted spear-phishing message — is extremely difficult to distinguish from legitimate correspondence, even for trained security professionals.

How Our Email Phishing Assessments Work

Grid32's email phishing campaigns use a staged approach. We begin with broad, low-sophistication messages — the kind your email filters should catch — and progressively increase sophistication, advancing to:

• Targeted spear-phishing using publicly available information about your organization
• Business email compromise scenarios impersonating executives or finance personnel
• Mimicked domains that closely resemble your organization's actual domains
• Credential harvesting pages that capture login attempts
• Malicious attachment simulations that assess whether users open files from unknown senders

This staged approach reveals not just whether your users will fall victim, but at what level of sophistication — which is exactly the information you need to calibrate your defenses.

What We Measure

Our email phishing report tracks open rates, click rates, credential submission rates, and attachment interaction rates across all campaign stages. Results are provided at both aggregate and individual level (where authorized), enabling targeted follow-up training for the most susceptible users.

Combining With Security Awareness Training

The results of a real phishing assessment are the most powerful input for security awareness training. Employees who fell for a simulated attack are far more receptive to learning — the experience makes the risk real in a way that generic training videos never can.