Phishing tests

Find out who would click. Before a criminal does.

fromIT sends your team safe, realistic test emails that look just like the real thing. Anyone who clicks gets a short, friendly lesson on the spot, and you get a clear picture of how your team is doing.

  • Cyber Essentials certified
  • UK based
  • No long contract
43%

of UK businesses had a cyber breach or attack in the last year.

38%

of businesses were hit by phishing, by far the most common attack.

19%

of businesses gave their staff any security training.

Source: Cyber Security Breaches Survey 2025/2026, UK government.

How it works

Three steps. Then it runs itself.

No software to install and no extra work for your team.

  1. Connect your email

    fromIT links to Microsoft 365 or Google Workspace, so tests land straight in inboxes without switching off your email security.

  2. Tests go out

    Realistic emails arrive at random times through the month, based on scams seen in real UK incidents.

  3. Your team improves

    Clickers learn on the spot. You get a monthly report showing who clicked, who reported it and the trend.

What your team sees

Realistic first. Then kind.

The point isn't to catch people out. It's to make the warning signs stick.

Inbox

From: Accounts <billing@invoice-portal.co>
Subject: Overdue invoice INV-20431

Hi, please find the overdue invoice for October attached. Payment is now 14 days late and a fee will be added on Friday.

View invoice
fromIT · phishing test

That one was a test.

No harm done. Three things gave it away:

A sender you don't buy from01
Pressure: “a fee will be added on Friday”02
A vague invoice you weren't expecting03
  1. 1

    A believable fake

    Fake invoices, shared files, delivery notes, QR codes. The tricks criminals use on UK businesses every day.

  2. 2

    An instant lesson

    Anyone who clicks sees what gave it away, there and then. It takes two minutes and nobody is named and shamed.

  3. 3

    A report button

    Staff can report suspicious emails in one click. More reports is the real sign your team is getting sharper.

What you get

Everything included

  • 400+ test templates

    Email, attachment and QR code tests, matched to the tools your team actually uses.

  • Random timing

    Tests arrive at different times for different people, so nobody can warn the office.

  • One-click reporting

    A report button in Outlook and Gmail builds the habit that stops real attacks.

  • Monthly report

    Click rate, report rate and the trend, ready for your insurer, auditor or board.

  • Never to embarrass

    Results are reported for the team. Individual results stay private to you.

  • Tuned over time

    Tests get harder as your team gets better, so nobody coasts.

Price

Simple, monthly pricing

Your first test is free, so you can see where your team stands before you spend a penny.

Monthly, no long contract£2.50per person, per month

Minimum £35 a month. Add or remove people any time.

Get a free test

Included

  • A new test every month
  • Instant lessons for clickers
  • 400+ realistic templates
  • QR code and attachment tests
  • One-click report button
  • Monthly report
  • Microsoft 365 and Google Workspace
  • Set up for you by fromIT

Save with a bundle. Essentials includes staff training, phishing tests, policies and dark web monitoring for £3.50 per person, per month.

Compare bundles →
FAQ

Good questions

Will my staff feel caught out?

They shouldn't. Anyone who clicks sees a short, friendly lesson straight away. Results are reported for the team as a whole, and the goal is more people reporting suspicious emails, not people being afraid to open their inbox.

Should we tell staff about the tests?

Yes, tell them testing will happen, but not when. It's fair, it builds trust, and it keeps the tests realistic.

Will it interfere with our email security?

No. Tests are delivered directly through Microsoft 365 or Google Workspace, so your spam filtering stays exactly as it is.

Does it count towards Cyber Essentials or ISO 27001?

Phishing tests aren't a Cyber Essentials requirement, but they back up how you educate staff. For ISO 27001 they are strong evidence of ongoing awareness under Annex A 6.3.

Is there a contract?

No long contract. It's billed monthly by headcount and you can stop with 30 days' notice.

What does the free test include?

One realistic test email to your team, followed by a short call to walk through who clicked and what it means. No obligation.

See who would click.
Free.

Book a 30 minute call and fromIT will send one realistic test email to your team, then walk you through the results. No obligation, no sales script.