A phishing test sends employees fake phishing e-mails, built like a real attacker’s. It measures who clicks, who enters a password and who reports the message. Avepto runs it all year round for Swiss SMEs, with scenarios matched to each person’s role and a short lesson the moment a mistake is made.
Test your employees
against phishing.
We send each of your employees fake phishing e-mails throughout the year, and a short lesson arrives the moment a mistake is made.
Phishing awareness
Phishing at work,
one click is enough.
Human error is among the most frequent causes of security incidents in companies. Often, it all starts with a single click in a phishing e-mail.
Phishing in Switzerland
+25%
more phishing cases recorded by the cantonal police in 2025.
Police crime statistics 2025
Who tests their employees
Small companies 24%
Mid-sized companies 63%
Deloitte Switzerland, 2026
Reports to the NCSC
12,280
phishing attempts reported to the National Cyber Security Centre in 2025.
Half-year report 2025/II
The employee journey
The phishing test,
as your employees experience it.
Three actions, one reflex. Your employees practise it throughout the year.
Real campaigns in Switzerland
Your employees,
your strongest line of defence.
Your employees train all year round, with short exercises that keep them engaged. The right reflex takes hold for good, and your company gains a human firewall.
An invoice from a regular supplier arrives with a link to view it. The sender’s address has changed. What do you do?
Swiss authorities
- A refund from the FTA
The Federal Tax Administration owes you an amount.
- The Serafe licence fee
An unpaid radio and TV invoice, chased before debt collection.
- The commercial register
An invoice that imitates the official publication of your details.
Everyday services
- A Swiss Post parcel on hold
CHF 2.90 in customs fees to pay before the parcel is delivered.
- Your SwissPass
Your SBB travelcard expires, a link to renew it.
- Your Cumulus or Supercard points
Loyalty points expiring tomorrow, a link to convert them.
Banking and payment
- A UBS or PostFinance alert
Your e-banking access is blocked, a link to reactivate it.
- A TWINT or PayPal payment
A refund is waiting, you only need to accept it in one click.
- A QR-bill
An invoice to pay, with a new payment code.
Payment fraud
- CEO fraud
Management asks for an urgent, discreet transfer.
- A new supplier IBAN
A supplier announces a change of bank details.
- A fake supplier invoice
A link to view an invoice from a regular supplier online.
For audit and insurance
Progress you can measure.
A documented organisational measure, as standards, the law or your cyber insurance policy expect.
- ISO/IEC 27001International standard
- NIS2European directive
- FADPSwiss law
The organisation’s progress curve: after a year of tests, employees report two fake e-mails for every click.
Management report 01
One page, for the board or the committee.
- Click and report rates
And their trend since the tests began.
- Departments to watch
Where the risk concentrates, with no employee name.
- Priorities for what comes next
What changes in the next campaigns, and why.
Compliance report: the coverage of trained employees, shared with management, the auditor and the insurer.
Compliance report 02
Proof that the measure exists and is alive.
- The full history
Every campaign, dated, with its results.
- Coverage
Who was tested, who was trained, how often.
- Ready for the file
A dated, exportable document to attach to the audit or the insurer’s request.
Radar chart of one employee’s review: their results by topic, compared with their previous review.
Individual review 03
Every six months, for each employee.
- Their progress, topic by topic
The traps they recognise and the ones that still catch them.
- Measured against themselves
Compared with their previous review, not with their colleagues.
- Their next exercises
The topics their next simulations work on.
Implementation
Set-up on autopilot,
traps tailored to every inbox.
Your involvement comes down to a few approvals: access to your Microsoft 365, then the message that informs your employees. Avepto connects your tools, runs the campaigns and presents the results to you. A contact in French-speaking Switzerland follows your company throughout the programme.
- 01
Connect your tools
Set-up
The service fits into your tools.
Connection to your Microsoft 365
Employees, their roles, their departments and their language are taken directly from your directory.
A report button
Deployed in Outlook on every workstation, it reports a suspicious e-mail in one click, simulated or real.
- 02
Inform your teams
Internal communication
We draft it, you approve it.
A message written with you
It explains why the tests are being run, what happens after a click and how the results will be used.
Sent before the first test
Employees know that tests will take place. They know neither the date nor what the e-mails look like.
- 03
Train the reflexes
Simulations
Campaigns all year round.
Scenarios for each person
They follow role, department, language and level. The difficulty grows with the reflexes acquired.
A lesson at every mistake
After a click, the missed clues appear at once, so people learn with no ranking and no sanction.
- 04
Measure progress
Follow-up
Clear figures, reviewed with you.
Commented reports
Click rate, report rate, departments to support. We go through them with you at regular intervals.
Priorities for what comes next
The adjustments to make, the points to reinforce and what is useful for the audit or the insurer.
Frequently asked questions
Your questions on
phishing tests.
Telling your teams, the moment of the click, Microsoft 365, the scenarios: what to know before a first campaign.
Yes. A team that has been told treats the test as training, not as a trap. Before the first campaign, an announcement explains that the company is training, why, and what follows a click. Avepto writes it with you. It gives neither the sending dates nor what the e-mails look like, so the measurement stays true.
A page opens at once and shows the clues they missed: the sender’s address, the link, the pressing tone. The lesson lands when it counts, while the mistake is still fresh. The employee is neither singled out nor sanctioned. Management follows rates by department and by scenario, not a list of names.
In part. Microsoft’s simulations require Defender for Office 365 Plan 2, included in the E5 licence. Business Premium, the usual SME licence, includes Plan 1, with no simulation. Avepto runs the programme on its simulation platform, connected to your Microsoft 365, and handles the scenarios, the campaigns and the follow-up for you.
Yes, short scenarios. With Avepto’s phishing test, an exercise also arrives in the inbox, a USB stick found in the car park for instance, with a question and three answers. The employee picks one, then reads why it is the right reflex or not. Scenarios follow each person’s role, department and language, and their difficulty grows with the reflexes acquired.
Continue exploring
Related services,
and the reading that goes with them.
The services most often deployed alongside this one, and the field notes published by our specialists.
Related services
Next step
Take stock of your employees.
A meeting to assess whether the service suits your company. We then prepare the set-up with you.