Test your people before attackers do
Launch realistic, localised phishing campaigns, measure who is at risk, and remediate automatically with targeted training and reportable evidence.
- Click and credential-submission rates per campaign
- Repeat offenders and high-risk departments
- Report-phish rate and response times
The phishing risk challenge
Phishing remains the leading initial access vector, yet most organizations have no reliable measure of how their workforce actually behaves under attack.
- Manual compliance: ad-hoc tests run once a year, if at all
- Spreadsheet dependency: click results tracked manually and never revisited
- Audit fatigue: no consistent evidence of testing and remediation
- Evidence gaps: failures recorded with no follow-up training proof
- Fragmented risk visibility: phishing susceptibility absent from risk registers
- Poor board reporting: no trend data on human risk exposure
- Vendor risk blind spots: contractors and third-party staff never tested
Continuous human-risk testing
Waaqi runs simulations on a cadence, closes the loop with automatic training, and turns results into a governed, reportable metric.
Realistic localised lures
Regional, sector-specific templates in Arabic and English modelled on live campaigns.
Automatic remediation
Clickers are enrolled instantly in targeted training with tracked completion.
Governed reporting
Susceptibility trends feed risk registers, control evidence, and board packs.
What you get inside Waaqi
Every module works from one control library, one evidence store, and one risk register.
Template Library
Curated phishing templates by difficulty, theme, language, and sector.
Campaign Builder
Configure senders, landing pages, schedules, and drip delivery.
Auto-Remediation
Failures trigger enrolment in matched awareness modules.
Susceptibility Metrics
Click, submit, report, and repeat-offender rates by team.
Report-Phish Tracking
Reward and measure users who report suspicious mail correctly.
Risk Profiles
Per-user and per-department human-risk scores over time.
Custom Scenarios
Build your own lures, including smishing and QR-based scenarios.
Evidence Export
Exportable campaign and remediation records for auditors.
From control definition to audit-ready evidence
Each step is owned, dated, and traceable, so nothing depends on a spreadsheet or a single person.
- Step 1
Plan
Select templates, audiences, difficulty, and cadence.
- Step 2
Simulate
Deliver campaigns safely with staggered sending and safe landing pages.
- Step 3
Educate
Deliver instant teachable moments and enrol failures in training.
- Step 4
Report
Trend susceptibility, close findings, and evidence the control.
Evidence for human-risk controls
Show that phishing resilience is tested, measured, and remediated on a defined cadence.
- Campaign plans, scope, and authorisation records
- Result sets with click, submit, and report outcomes
- Remediation training assignments and completion
- Trend reports across periods and business units
- Mapping to awareness and human-risk framework controls
Board level answers without a fire drill
Boards, CISOs, and risk committees get the same numbers the compliance team works from.
Measurable risk reduction
Repeat simulation cycles drive click rates down quarter over quarter.
Faster incident reporting
Trained users report real phishing sooner, shortening attacker dwell time.
Defensible evidence
Every campaign and remediation action is recorded and exportable.
Questions we get asked
What is phishing simulation?
Phishing simulation sends controlled, realistic fake phishing emails to your workforce to measure susceptibility, identify high-risk users, and drive targeted training.
Are the templates localised?
Yes. Waaqi provides regional and sector-relevant templates, including Arabic and English lures modelled on real campaigns seen in the UAE, KSA, and wider region.
What happens when someone clicks?
Clicks, credential submissions, and attachment opens are recorded, the user receives an immediate teachable moment, and targeted follow-up training is triggered automatically.
Does this help with compliance?
Yes. Simulation results and follow-up training provide direct evidence for awareness and human-risk controls under ISO 27001, PDPL, NCA ECC, ADHICS, and SAMA CSF.
Find your weak links safely
See how Waaqi runs phishing simulation as a continuous, audit-ready control.