Phishy Phishy trains your people to spot the tell before it costs you — campaign creation, targeting, scoring, and certification tracking, all running natively inside ServiceNow.
From building a target list to watching a Risk Behaviour Score decay over time, Phishy Phishy keeps the whole lifecycle of a campaign inside ServiceNow — where your Security Managers already work.
Choose a template, a spoofed or internal domain, and the scenario your people need to recognise.
Attribute-based targeting pulls the right people in, and keeps the ones who shouldn't be, out.
Business-hours-aware scheduling sends on your terms, not whenever a queue happens to clear.
Every click, report, and non-response feeds a Risk Behaviour Score that decays as good habits stick.
Group people by what's true about them today, not a static list that goes stale the moment someone changes teams.
A single, decaying score per person that reflects recent behaviour, not a permanent mark from one bad click.
See who's completed awareness training and follow up automatically on the rest — no spreadsheet required.
Internal and customer-domain templates send through your own Microsoft 365 tenant. Spoofed-domain templates route through an isolated environment.
Campaigns send on your terms — configurable send windows so simulations land when your people are actually at their desks.
An automated ATF suite checks the install itself, so you know the platform is configured correctly before a campaign goes live.
Exclude specific people or groups from any campaign — no awkward exceptions handled over email.
Campaign results live in ServiceNow's own reporting tools, not a separate dashboard your team has to remember to check.
Phishy Phishy ships as a single plan — no feature gates, no tier to grow into.
Microsoft 365 is the supported recipient environment for this release. Internal and customer-domain templates send through your own tenant; spoofed-domain templates route through an isolated sending environment we manage.
Phishy Phishy supports the current and prior ServiceNow release family. If you're on an older release, get in touch and we'll confirm compatibility.
Campaign data, targeting, and scoring stay inside your instance. Only email delivery for spoofed-domain templates routes through our isolated sending environment.
Each person's score reflects recent campaign behaviour and decays linearly over time, so a single bad click doesn't follow someone indefinitely once habits improve.
Yes — recipient suppression lets you exclude individuals or groups from any campaign, with the exclusion applied automatically going forward.