Starter Human Risk Management resources for your business.
Below, we have provided free phishing simulators, awareness media, and comprehensive training modules. We offer these resources because we believe cybersecurity education should be universally accessible. Cyber threats target everyone indiscriminately—from children to the elderly. When organisations or individuals lack the resources to secure professional services, they remain vulnerable. We are deeply committed to closing this security gap and ensuring our global community is informed, resilient, and fully equipped against modern threat actors.
Should you require white listed, professional training tailored for your business, including awareness events and activities such as gamification, escape rooms and awareness media, please contact us for a no-obligation discussion.
Phishing Tools
Gophish
A widely popular, open-source phishing framework. It is incredibly well-maintained, powerful, and allows businesses to safely run internal phishing simulations to train staff. Gophish can be used for large-scale phishing campaigns.
Requires a small amount of technical setup (e.g., spinning up a free or cheap cloud instance)
Use your preferred AI agent to obtain detailed environmental setup and installation instructions. Video training and usage modules from Gophish are available on YouTube.
IRONSCALES Starter
Free phishing simulation product with a phishing incident insights dashboard, reporting and analytics of the phishing campaign, SSO integration, etc. – all in one tool.
The phishing simulation service provides a fast setup for a phishing simulation campaign, taking the burden of configuration and integrations away from the security team. It allows your team to incorporate it with M365 in a simple two-click integration process. Additionally, it adds a “Report Phishing Button” to the Outlook email client, making it easier for employees to report the email to the security team.
The link to the free simulator is a bit challenging to find, but we did, and provided below.
Microsoft Attack Simulator
We haven’t had positive experiences with this tool due to access complexity, US-focused training modules, the appearance of and limited number of training modules compared to similar tools, and lack of required functionality which we expect from an enterprise-grade solution.
- You need a Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 license.
- You must have the Security Administrator role or Attack Simulation Administrator role.
- Unified Audit Logging must be turned on.
That said: If you have the relevant Microsoft licensing, it comes bundled with Microsoft Defender. Don’t let our hesitance keep you from trying this tool – the choice is always yours and it may fulfill your specific requirements.
https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-simulations
Awareness Media & Training Material
These resources have been vetted and are shareable. Augment your phishing campaigns with user training, awareness campaigns through email, posters, screensavers, internal social media environments (Teams/Slack) and more.
CISA’s “Secure Our World” Toolkit
CISA (US Cybersecurity & Infrastructure Security Agency) provides completely free, unbranded, and highly professional awareness resources. This includes downloadable posters, tip sheets, and video resources focusing on four simple pillars: strong passwords, MFA, recognizing phishing, and updating software.
NIST Cybersecurity Awareness Resources
The National Institute of Standards and Technology (NIST) provides free awareness training toolkits, pamphlets, and framework documentation designed specifically for small businesses.
Scroll to the middle of the site page where you’ll find relevant resources.
https://www.nist.gov/cybersecurity-awareness-month/resources
NIST also has a Small Business Cybersecurity Corner which may be of interest:
SANS Institute: The No-Tech Hacking / Social Engineering Posters
SANS publishes a free monthly security awareness newsletter called OUCH!. It is translated into multiple languages and acts as a ready-made artefact that small businesses can distribute to their staff via email or slack. Join for free, and sign up to receive the newsletter in your mailbox regularly.
Side fact: SANS used to stand for SysAdmin, Audit, Network, Security. This has since been fully substituted to only using ‘The SANS Institute’.
https://www.sans.org/newsletters/ouch
SANS also has a Cybersecurity Posters and Cheat Sheets section:
Wizer
Explore free security awareness training resources, phishing templates, developer security tools, cybersecurity guides, and family online safety content.
Legal Notice
Soveren Cyber may provide information about third-party products or services, including security tools, videos, templates, guides, and other resources included in our website (collectively, “Third-Party Content”). You are solely responsible for your use of Third-Party Content, and you must ensure that your use of Third-Party Content complies with all applicable laws, including applicable laws of your jurisdiction and applicable export compliance laws. We provide Third-Party Content as a service to those interested in such content. Your dealings or correspondence with third parties and your use of or interaction with any Third-Party Content are solely between you and the third party. Soveren Cyber does not control or endorse, and makes no representations or warranties regarding any Third-Party Content, and your access to and use of such Third-Party Content is at your own risk.