In short: usecure uPhish is the phishing simulation product in the usecure platform. Auto Phish sends each user a simulated phishing email at a random time within an interval you set, drawing on more than 400 templates, then tracks opens, clicks and compromises and automatically enrols anyone caught in short uLearn micro-training.
What uPhish is for
A phishing simulation shows how your staff behave when a convincing email arrives, which no amount of classroom training can tell you. uPhish lets you send safe, simulated phishing emails to your own people, see who opens, clicks or would have entered a password, and give them immediate, relevant training.
The point is practice, not punishment. The NCSC's phishing guidance is openly cautious about simulations: it warns that blaming people for clicking does not work, advises against reprimanding staff who struggle to spot phishing, suggests checking with HR before running simulations and recommends counting how many people report a suspicious email, not only how many click. uPhish is most effective when it is run in that spirit. For the wider guidance, see NCSC security awareness guidance.
How Auto Phish works
Auto Phish removes the work of planning campaigns. You set how often simulations should run, such as every four or eight weeks, and each person receives one simulation per interval at a random time within it, so colleagues do not all receive the same email at once and warn each other. The cycle then repeats. You can restrict sending to working hours, include or exclude pre-built and custom templates, filter templates by language, choose sending domains and select the productivity tools your staff use so lures imitate emails they would genuinely expect.
usecure says campaigns adapt to user behaviour, and language matching sends each person simulations in their preferred language. Anyone who is compromised is enrolled straight into micro-training through uLearn, and the result feeds their risk score.
Templates and simulation types
| Capability | What it means in practice |
|---|---|
| Template library | usecure lists more than 400 ready-made phishing templates, including impersonations of familiar brands and region- and language-specific sets |
| Custom templates | A builder for your own scenarios, aimed at specific users or departments |
| Spear phishing | Simulated internal impersonation using domain spoofing, such as a fake request from a director |
| QR code and attachment lures | Included in the plan, reflecting how real attacks have moved beyond simple links; see QR code phishing |
| Landing pages | An email and landing page builder for convincing fake login pages, so you can see who would have entered credentials |
| Tracking | Opens, clicks and compromises in real time, compared across users, teams or the whole organisation |
Varying the lure is important. Simulations that only ever imitate parcel notifications teach people to spot parcel notifications. A mix of brand impersonation, internal requests, shared documents and QR codes builds a more general habit of checking.
Delivery: making sure simulations arrive
Simulations are only useful if your own defences do not quietly block them. uPhish supports two approaches:
- Allow-listing usecure's sending domains. With Microsoft 365, usecure prefers Microsoft's Advanced Delivery policy for third-party phishing simulations, with the Auto Phish sending domains matching those configured there (Advanced Delivery has a limit on how many domains it accepts, so the choice of sending domains matters)
- Message injection, which places simulations directly into inboxes for more reliable delivery and more realistic results
Getting this right is fiddly when you also run third-party email security, because link scanners can "click" every link and distort results. We configure it as part of set-up and check the first campaign's data before trusting it.
What to measure
uPhish reports opens, clicks and compromises across users, teams and the whole organisation, and the plan includes exportable reports for compliance and board updates. The most useful measures over time are:
- Compromise rate trend: are fewer people entering credentials each quarter?
- Repeat clickers: the small group who need more support, often better handled with a conversation than another email
- Departmental hotspots: finance, HR and executive assistants often face the most targeted lures
- Reporting behaviour: how quickly suspicious messages are reported through your normal phishing reporting route
Avoid treating a single campaign's click rate as a score. Difficulty varies between templates, so the trend matters more than any one number. See measuring security awareness training for a fuller set of metrics.
Licensing and how we help
uPhish is part of the core usecure plan, licensed per user together with uLearn, uPolicy and uBreach Starter; there is no separate premium phishing edition. Ask us for a quote, and see usecure uPhish licensing for the licensing detail.
We configure delivery and allow rules, run a baseline simulation, agree with you how results will be shared (we recommend telling staff simulations happen, without saying when), and tune templates to the attacks your sector actually sees. Contact us to book a baseline phishing test.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How often does usecure uPhish send simulations?
You choose the interval. Auto Phish then sends each person one simulation at a random time within each interval, optionally only during working hours, and repeats the cycle.
Does uPhish include QR code phishing simulations?
Yes. usecure lists QR code and attachment phishing among the uPhish features included in its standard plan.
What happens when someone fails a uPhish simulation?
They are automatically enrolled in a short, relevant micro-lesson through uLearn, and the result counts towards their risk score. The aim is learning, not blame.
Will our spam filter block uPhish emails?
It can if delivery is not configured. usecure supports allow-listing, Microsoft 365 Advanced Delivery and message injection. We set this up and check the first campaign so results are accurate.