Security awareness training · SaaS

Spot the Phish

Phishing training your team will actually finish. A 5-minute daily challenge, instant lessons on every red flag, and the proof your auditors ask for.

  • 5 min a day
  • 40+ realistic emails
  • 187 automated tests
  • WCAG AA accessible
Demo: a new employee accepts an invite, flags the red flags in a phishing email, reports it, sees their results; then the admin dashboard, quick search, team leaderboard and dark mode.
Demo with a fictional company. Every person, company and domain is made up.

The problem

Most breaches start with one click. Yearly 45-minute training videos are skipped, forgotten, or both.

The idea

Practise like a game, five minutes a day, on emails that look exactly like the real thing.

The result

Staff build a habit. Admins see readiness rise and export proof for auditors and cyber-insurance.

Signature mechanic

Tap the red flag

Reporting a phish is good. Knowing why is better. Before reporting, people flag the exact part that gave it away: the sender, the subject, a link, an attachment or the message itself.

  • +25 points for every real red flag, −10 for a wrong one, so guessing doesn't pay
  • Scored on the server, so nobody can cheat the leaderboard
  • Instant feedback shows what was spotted, what was missed, and why
Feedback after reporting a phishing email: You spotted 1 of 2 red flags, plus the missed Reply-To clue and an explanation.

Features

Built for both sides

For staff

  • Daily challenge: 10 new emails a day, one scored try, fair team leaderboards
  • Adaptive practice that learns each person's weak spots
  • Phone view that hides the sender, just like real mail apps
  • XP, levels and streaks, earned only by correct answers
  • No passwords: sign in with an email link, Microsoft or Google

For admins

  • Readiness score (accuracy + weekly participation) with next best actions
  • Assigned training with due dates, pass marks, reminders and PDF certificates
  • Reports: board-ready PDF and CSV exports, plus a full activity log
  • Microsoft 365 staff sync: new starters in, leavers out, automatically
  • Ctrl+K quick search and a notifications bell
Learner home with XP level, streak, assigned training and the daily challenge.
Learner home: level, streak, assigned training and today's challenge
Results after a daily challenge: 7 of 10 correct, XP earned and red flags spotted.
Results: score, XP and red flags spotted
Admin overview in dark mode with the readiness score and next best actions.
Admin overview (dark mode): readiness and next best actions
Team leaderboard with a top-three podium.
Team leaderboard
Phone: learner home.
Phone: home
Phone: training email in phone view, sender address hidden until tapped.
Phone: focus mode

Engineering

Built right

Tests

187

Unit, API and browser tests on desktop and phone, light and dark

Accessibility

0

axe-core violations; full keyboard play (R, S, N)

Security

Strict

Nonce CSP, passwordless sign-in, tenant-proof SSO, encrypted secrets

Data

Isolated

Every company separated; backups with a tested restore

Next.js React TypeScript libSQL / SQLite OpenID Connect Microsoft Graph Playwright Vitest Docker Vercel

Interested?

See it with your own team

Spot the Phish is in private preview. Send me a message on LinkedIn for a live demo.

Request a demo on LinkedIn Back to projects