# Fallax

> Fallax runs internal phishing simulations that teach the person at the moment they click and produce the per-recipient evidence an audit asks for. Messages are injected into a customer's own Google Workspace or Microsoft 365 mailboxes through their tenant, so nothing is filtered, everybody targeted is genuinely tested, and no sending domain or DNS record is involved.

**When to use Fallax.** Reach for these pages when the question is about running phishing simulations against your own staff, building a continuous security-awareness programme, evidencing ISO 27001 A.6.3, SOC 2, NIS2, DORA, PCI DSS or HIPAA awareness training, raising a phishing report rate, or comparing phishing-simulation platforms on published prices. The free tools (spoofing checker, header analyzer, DMARC generator) answer email-authentication questions without an account.

**When not to.** Fallax only tests an organisation's own people, with that organisation's authorisation. It does not test what a mail filter catches (simulations bypass the gateway by design), never stores the credentials typed into a simulated login page, and cannot launch a simulation from an assistant.

**How to call Fallax.** A read-only MCP server exposes one workspace's results to Claude, ChatGPT or any MCP client: see the agent instructions and the MCP documentation below. Every page here is also available as Markdown, at its own URL plus `.md` or by sending `Accept: text/markdown`.

## Agent instructions

- [Fallax agent instructions](https://fallax.io/agent-instructions.md): When an agent should reach for Fallax, what Fallax will not do, and how to call it.
- [Every page in one file](https://fallax.io/llms-full.txt): the whole site as a single Markdown document.

## Product

- [Fallax: phishing simulation and security awareness](https://fallax.io/index.md): Internal phishing simulations that teach your team at the moment they click, and produce audit evidence for ISO 27001, SOC 2, NIS2, DORA, PCI DSS and HIPAA.
- [Pricing | Fallax](https://fallax.io/pricing.md): Phishing simulation with one simple price at any size. The first 10 seats are free, then €1 per seat per month, falling to €0.40 at scale. Every feature on every account, no sales call.
- [Phishing simulation for Google Workspace and Microsoft 365](https://fallax.io/phishing-simulation.md): How Fallax delivers phishing simulations on Google Workspace and Microsoft 365: injected into the mailbox through your own tenant, with no sending domain, no DNS records and no filtering bypass to maintain.
- [Continuous programme: phishing simulation that runs itself](https://fallax.io/features/continuous-programme.md): Fallax gives every person their own schedule of phishing simulations, picks the lure by their measured security score, and keeps going until you pause it. Per-person timing, adaptive difficulty, hard guardrails, and the same audit evidence at the end.
- [App discovery: aim phishing simulations at the apps in use](https://fallax.io/features/app-discovery.md): Fallax reads which applications your Google Workspace or Microsoft 365 tenant federates, and which ones your people sign in to, then ranks the phishing templates to match. Opt-in, it never writes anything, and switching it off deletes everything it found.
- [Report inbox: a phishing report rate that measures itself](https://fallax.io/features/report-inbox.md): Staff press Report in Outlook, press Fallax's own Report phishing button inside Gmail, or forward the mail, and Fallax matches it back to the person and the simulation on its own. Nothing on anyone's machine, message bodies never stored, and the mail that matches nothing is kept as possible real phishing.
- [Standings: security training aimed at your report rate](https://fallax.io/features/standings.md): Points, streaks, badges and a department league, all earned by reporting phishing simulations. Built to move the one metric staff control, with no administrator to run it and nobody ranked by failure.
- [Fallax for Startups: 80% off for a year](https://fallax.io/startups.md): Under 100 people and facing a first SOC 2 or ISO 27001? 80% off the rate card for 12 months: the whole product, the full evidence export, and a bill of a few euros a month. Published eligibility, no sales call.
- [Fallax for MSPs: a workspace per client, one bill](https://fallax.io/msp.md): Run phishing simulation for every client you manage from one login and one monthly invoice. Seats are counted across your whole book so the volume rate is yours, the first 10 in every client are free, and the rate card is published.

## Delivery platforms

- [Phishing simulation for Google Workspace, inserted into Gmail](https://fallax.io/phishing-simulation/google-workspace.md): Run phishing simulations across Google Workspace without a sending domain, DNS records or a spam-filter allowlist. Fallax inserts each message into the target's Gmail inbox through the Gmail API, under one narrow scope, with per-person audit evidence.
- [Phishing simulation for Microsoft 365, delivered in your tenant](https://fallax.io/phishing-simulation/microsoft-365.md): Run phishing simulations across Microsoft 365 without a sending domain, DNS records or a filtering bypass. Fallax injects each message into the target's Outlook mailbox through Microsoft Graph, on any licence, with per-person audit evidence.

## By industry

- [Phishing simulation by industry](https://fallax.io/industries.md): Phishing simulation by sector: what lands in each one, who to test first, and which clause the evidence goes to.
- [Phishing simulation for healthcare, with HIPAA evidence](https://fallax.io/industries/healthcare.md): Phishing simulations for clinical and administrative staff, sent around the rota, with training at the click and a dated per-person record for HIPAA §164.308(a)(5). No sending domain to set up.
- [Phishing simulation for financial services, with DORA evidence](https://fallax.io/industries/financial-services.md): Test the people who can release a payment at their own difficulty, keep the management body as its own audience, and produce the dated per-person record DORA Art. 13(6) asks for.
- [Phishing simulation for law firms, for the client questionnaire](https://fallax.io/industries/law-firms.md): Clients ask how often your people are tested and what the record looks like. Fallax runs the simulations, trains at the click, and exports a dated per-person record you can attach to the answer or to an ISO 27001 visit.
- [Phishing simulation for insurers and brokers, with DORA evidence](https://fallax.io/industries/insurance.md): Claims, premiums and binding authority move by email between firms. Fallax tests the seats that hold that authority and keeps dated per-person evidence for DORA Art. 13(6) and your reinsurers.
- [Phishing simulation for SaaS companies, with SOC 2 evidence](https://fallax.io/industries/saas.md): A Type II auditor samples twelve months and one training date covers one day of it. Fallax runs all year, trains at the click, and syncs dated per-person participation into Vanta, Drata, Secureframe or Sprinto.
- [Phishing simulation for fintech: DORA and PCI DSS 12.6.3.1](https://fallax.io/industries/fintech.md): PCI DSS has named phishing explicitly since March 2025 and DORA asks the same of senior management. Fallax produces the dated per-person record both ask for, from each person's hire date.
- [Phishing simulation for agencies and consultancies](https://fallax.io/industries/professional-services.md): Your team's browsers hold your clients' logins. Fallax tests the people who hold them, trains at the click, and produces the dated per-person record the next client questionnaire asks for.
- [Phishing simulation for schools, staff only](https://fallax.io/industries/schools.md): Supplier invoices, fees and payroll go through a small office with wide authority. Fallax tests the staff who hold it, trains at the click, never targets pupils, and is free for the first ten people.
- [Phishing simulation for universities, faculty by faculty](https://fallax.io/industries/higher-education.md): A central programme has to work across faculties that run their own IT. Fallax turns directory departments into audiences, runs continuously, reports each faculty on its own, and publishes its rate card.
- [Phishing simulation for local government, with NIS2 evidence](https://fallax.io/industries/local-government.md): Staff names and roles are published by law, so the target list is free. Fallax tests those people continuously, produces the per-person record NIS2 Art. 21(2)(g) asks for, and publishes a rate card procurement can use.
- [Phishing simulation for nonprofits, with evidence for funders](https://fallax.io/industries/nonprofits.md): Grants arrive by transfer, donations by card, and volunteers every month with real access. Fallax tests the people handling all three and produces a dated per-person record a funder or a PCI assessor accepts.
- [Phishing simulation for manufacturing, with NIS2 evidence](https://fallax.io/industries/manufacturing.md): Fraud reaches a manufacturer through purchasing, and NIS2 puts a training duty on the entity and its management. Fallax tests the office estate, reports each site on its own, and needs no sending domain.
- [Phishing simulation for logistics, spread across shifts](https://fallax.io/industries/logistics.md): Rate requests, customs holds and delivery exceptions arrive at all hours from unfamiliar parties. Fallax tests the desks that answer them across every shift and keeps the per-person record NIS2 asks of transport entities.
- [Phishing simulation for construction, aimed at payment fraud](https://fallax.io/industries/construction.md): Projects run on temporary relationships and large scheduled payments. Fallax tests the commercial and finance seats that approve them and produces a dated per-person record for prequalification questionnaires.
- [Phishing simulation for retail, with PCI DSS 12.6.3.1 evidence](https://fallax.io/industries/retail.md): PCI DSS asks for phishing training at hire as well as annually, and an annual cycle misses the seasonal intake. Fallax runs continuously, so someone hired in November is tested in November.

## Glossary

- [Phishing and security-awareness glossary](https://fallax.io/glossary.md): Plain definitions of the phishing, email-authentication and security-awareness terms a programme runs into: BEC, vishing, smishing, quishing, SPF, DKIM, DMARC and more.
- [What is phishing? Definition and examples](https://fallax.io/glossary/phishing.md): Phishing is a message that impersonates someone trusted to make a person click a link, open a file or type a password. How it works and how to spot it.
- [What is spear phishing?](https://fallax.io/glossary/spear-phishing.md): Spear phishing is a targeted phishing message written for one person, using real details about their job, colleagues or projects to make it convincing.
- [What is whaling in cybersecurity?](https://fallax.io/glossary/whaling.md): Whaling is spear phishing aimed at executives: the CEO, CFO or board, whose sign-off and access make a single successful message especially costly.
- [What is business email compromise (BEC)?](https://fallax.io/glossary/business-email-compromise.md): Business email compromise is email fraud that impersonates an executive, colleague or supplier to redirect a payment or extract data. Often no malware at all.
- [What is vishing (voice phishing)?](https://fallax.io/glossary/vishing.md): Vishing is phishing by phone: a caller poses as IT, a bank or a supplier and talks the target into revealing a code or approving access in real time.
- [What is smishing (SMS phishing)?](https://fallax.io/glossary/smishing.md): Smishing is phishing by text message: a short lure about a parcel, a bank alert or a work request, with a link to a fake page. Why phones make it work.
- [What is quishing (QR code phishing)?](https://fallax.io/glossary/quishing.md): Quishing hides a phishing link inside a QR code. The target scans it with a phone, moving off the protected device and past the mail filter's link checks.
- [What is clone phishing?](https://fallax.io/glossary/clone-phishing.md): Clone phishing copies a genuine email the target has already seen and resends it with the link or attachment replaced, often as an updated or resent version.
- [What is pretexting?](https://fallax.io/glossary/pretexting.md): Pretexting is the invented backstory behind a social-engineering attack: a plausible reason, like a new supplier or an urgent audit, that justifies the request.
- [What is pharming?](https://fallax.io/glossary/pharming.md): Pharming redirects a correctly typed web address to a fake site by tampering with DNS or a device's hosts file. No bad link to click, which is what makes it hard to spot.
- [What is SPF (Sender Policy Framework)?](https://fallax.io/glossary/spf.md): SPF is a DNS record that lists the servers allowed to send email for a domain. The receiver checks the sending server against it. One of the three email-auth checks.
- [What is DKIM (DomainKeys Identified Mail)?](https://fallax.io/glossary/dkim.md): DKIM adds a cryptographic signature to an email so the receiver can confirm it really came from the domain and was not changed on the way. One of the three email-auth checks.
- [What is DMARC?](https://fallax.io/glossary/dmarc.md): DMARC ties SPF and DKIM to the visible From address and tells receivers what to do with mail that fails: nothing, quarantine or reject. It also returns reports.
- [What is DMARC enforcement?](https://fallax.io/glossary/dmarc-enforcement.md): DMARC enforcement is moving the policy from p=none to quarantine or reject, so mail that fails is actually filtered. The step that turns reporting into protection.
- [What is BIMI?](https://fallax.io/glossary/bimi.md): BIMI displays a verified brand logo beside authenticated email in the inbox. It requires DMARC at enforcement, which is the real reason to set it up.
- [What is email spoofing?](https://fallax.io/glossary/email-spoofing.md): Email spoofing forges the sender address so a message looks like it came from a trusted person or domain. SPF, DKIM and DMARC exist to stop it.
- [What is display-name spoofing?](https://fallax.io/glossary/display-name-spoofing.md): Display-name spoofing sets the visible sender name to a trusted person, while the real email address is the attacker's. It passes SPF and DMARC because the domain is genuine.
- [What is a lookalike domain?](https://fallax.io/glossary/lookalike-domain.md): A lookalike domain is registered to resemble a real one: a swapped letter, an extra word, a different ending. It passes email authentication because the attacker owns it.
- [What is typosquatting?](https://fallax.io/glossary/typosquatting.md): Typosquatting registers common misspellings of a popular domain to catch mistyped traffic or to impersonate the brand in phishing. A subset of lookalike domains.
- [What is a homograph attack?](https://fallax.io/glossary/homograph-attack.md): A homograph attack uses look-alike characters from other alphabets, like a Cyrillic a, to register a domain that is visually identical to a real one but technically different.
- [What is social engineering?](https://fallax.io/glossary/social-engineering.md): Social engineering manipulates people rather than systems, using trust, authority, fear or helpfulness to make someone act against their own interest. Phishing is its most common form.
- [What is credential harvesting?](https://fallax.io/glossary/credential-harvesting.md): Credential harvesting captures usernames and passwords, typically through a fake login page that mimics a real service. The most common goal of a phishing link.
- [What is a lure in phishing?](https://fallax.io/glossary/lure.md): A lure is the bait in a phishing attack: the themed message and pretext, like a shared document or a bank alert, designed to make the target click or respond.
- [What is a phishing landing page?](https://fallax.io/glossary/clone-landing-page.md): A clone landing page is the fake site a phishing link leads to, copied from a real login or payment screen to capture whatever the victim types.
- [What is an adversary-in-the-middle (AiTM) attack?](https://fallax.io/glossary/adversary-in-the-middle.md): An adversary-in-the-middle attack proxies a victim's login to the real site in real time, capturing the session token after MFA succeeds, so the second factor is bypassed.
- [What is session hijacking?](https://fallax.io/glossary/session-hijacking.md): Session hijacking steals the token or cookie that keeps a user signed in, letting the attacker take over the account without the password or a second factor.
- [What is MFA fatigue (push bombing)?](https://fallax.io/glossary/mfa-fatigue.md): MFA fatigue, or push bombing, floods a victim with login-approval prompts until they tap approve out of annoyance or confusion, handing over the second factor.
- [What is a watering hole attack?](https://fallax.io/glossary/watering-hole-attack.md): A watering hole attack compromises a legitimate site a target group trusts and visits, infecting them when they come to it. The reverse of chasing victims with phishing.
- [What is DNS spoofing?](https://fallax.io/glossary/dns-spoofing.md): DNS spoofing, or cache poisoning, corrupts the domain-name lookup so a correctly typed address resolves to an attacker's server. The mechanism behind pharming.
- [What is security awareness training?](https://fallax.io/glossary/security-awareness-training.md): Security awareness training teaches employees to recognise phishing, social engineering and the other human-targeted attacks that filters cannot stop. Often required for compliance.
- [What is a phishing simulation?](https://fallax.io/glossary/phishing-simulation.md): A phishing simulation is a safe, authorised fake phishing attack run against your own employees, with consent, to measure how they respond and teach the ones who click.
- [What is a phish-prone rate (click rate)?](https://fallax.io/glossary/phish-prone-rate.md): The phish-prone rate is the share of people who clicked or submitted in a phishing simulation. The headline measure of exposure, best tracked over time and by team.
- [What is the phishing report rate?](https://fallax.io/glossary/report-rate.md): The report rate is the share of people who reported a phishing simulation as suspicious. It measures active defence and is the number that should rise as a programme matures.
- [What is a phishing report button?](https://fallax.io/glossary/report-button.md): A report button adds one-click reporting of suspicious email to the mail client, sending it to security and, in a simulation, crediting the person who reported it.
- [What is just-in-time training?](https://fallax.io/glossary/just-in-time-training.md): Just-in-time training delivers a short lesson the moment someone clicks a simulated phish, when the mistake is fresh, instead of saving it for a scheduled course.
- [What is human risk management (HRM)?](https://fallax.io/glossary/human-risk-management.md): Human risk management treats employees as a measurable source of risk: scoring behaviour, targeting the riskiest people and tracking change over time, rather than training everyone the same.

## Compliance and integrations

- [Compliance evidence: ISO 27001, SOC 2, NIS2, DORA, PCI DSS](https://fallax.io/compliance.md): One per-recipient evidence export, mapped to the security-awareness clause in ISO 27001 A.6.3, SOC 2 CC1.4, NIS2 Art. 21(2)(g), DORA Art. 13(6), PCI DSS 12.6.3.1, HIPAA and NIST CSF, with continuous sync to Vanta, Drata, Secureframe and Sprinto.
- [ISO 27001 A.6.3 awareness training: evidence for the period](https://fallax.io/compliance/iso-27001.md): ISO/IEC 27001:2022 control A.6.3 asks for awareness, education and training with regular updates, clause 7.2 for evidence of competence, and clause 9.1 for measurement. What Fallax produces for each, and what a surveillance auditor samples.
- [SOC 2 security awareness training: CC1.4 and CC2.2 evidence](https://fallax.io/compliance/soc-2.md): SOC 2 tests security awareness under common criteria CC1.4 and CC2.2, and a Type II auditor samples people across the whole observation window. What Fallax produces for it, synced per person into Vanta, Drata, Secureframe or Sprinto.
- [NIS2 cybersecurity training: Article 21(2)(g) and 20(2)](https://fallax.io/compliance/nis2.md): NIS2 puts cybersecurity training for staff in Article 21(2)(g) and training for the management body in Article 20(2). Implementing Regulation 2024/2690 spells out a programme that is repeated, covers new employees and is tested for effectiveness. What Fallax produces for each.
- [DORA Article 13(6): ICT security awareness training evidence](https://fallax.io/compliance/dora.md): DORA Article 13(6) makes ICT security awareness programmes compulsory for all employees and senior management, at a complexity matched to their function, and Article 5(4) has the management body follow regular training. What Fallax produces for both.
- [PCI DSS 12.6.3.1: phishing awareness training evidence](https://fallax.io/compliance/pci-dss.md): Since 31 March 2025, PCI DSS requirement 12.6.3.1 makes phishing and social engineering a mandatory part of security awareness training, given at hire and at least every 12 months under 12.6.3. What Fallax produces for requirement 12.6, for a SAQ or a QSA assessment.
- [HIPAA §164.308(a)(5): security awareness training evidence](https://fallax.io/compliance/hipaa.md): The HIPAA Security Rule requires a security awareness and training program for all workforce members, management included, with periodic security reminders, and documentation kept for six years. What Fallax produces for §164.308(a)(5).
- [GDPR Article 32: staff awareness as a measure you can show](https://fallax.io/compliance/gdpr.md): GDPR Article 32(1)(d) asks for a process for regularly testing the effectiveness of your security measures, Article 39(1)(b) has the DPO monitor staff training, and Article 5(2) makes you demonstrate all of it. What Fallax produces for each.
- [NIST CSF 2.0 PR.AT-01 and PR.AT-02: awareness evidence](https://fallax.io/compliance/nist-csf.md): NIST's own implementation examples for CSF 2.0 PR.AT-01 say to train users to recognize social engineering, to report it, and to periodically test them. What Fallax produces for PR.AT-01 and PR.AT-02, and how it moves a Current Profile.
- [CyFun® awareness and training controls: evidence per person](https://fallax.io/compliance/cyfun.md): The CyberFundamentals (CyFun®) awareness and training controls, PR.AT-01 and PR.AT-02, mapped to what Fallax produces: a running phishing simulation programme and a dated, per-person evidence export for your Basic, Important or Essential assessment.
- [BIO2 6.03 awareness training: demonstrable, per person](https://fallax.io/compliance/bio2.md): BIO2 asks every Dutch government entity to show that staff and contractors completed awareness training within three months of joining (6.03.02) and that management keeps it going (6.03.03). What Fallax produces for the government measures under control 6.3.
- [IT-Grundschutz ORP.3: awareness and training evidence](https://fallax.io/compliance/it-grundschutz.md): BSI IT-Grundschutz module ORP.3 asks for a target-group awareness programme (A4, A6), measured learning success (A8) and deeper training for exposed people (A9). What Fallax produces for each requirement, for an ISO 27001 audit on the basis of IT-Grundschutz.
- [NCSC CAF B6 staff awareness and training: the evidence](https://fallax.io/compliance/ncsc-caf.md): Principle B6 of the NCSC Cyber Assessment Framework marks training as not achieved when records are incomplete or success is measured only by the number of people reached. What Fallax produces against the B6.a and B6.b indicators of good practice, for a NIS regulator or a GovAssure review.
- [ENS mp.per.3 and mp.per.4: awareness evidence per person](https://fallax.io/compliance/ens.md): Spain's Esquema Nacional de Seguridad (Royal Decree 311/2022) requires regular awareness of social engineering and incident reporting under mp.per.3, and evaluated training under mp.per.4. What Fallax produces for both, for a BÁSICA self-assessment or a MEDIA or ALTA certification audit.
- [ACN NIS baseline PR.AT-01: the training register](https://fallax.io/compliance/acn-nis.md): Italy's ACN baseline measures for NIS entities require a documented training plan that includes the board, and an up-to-date register of who was trained, on what, and how it was verified. What Fallax produces for PR.AT-01 and PR.AT-02.
- [CMMC AT.L2-3.2.1 awareness training: records for the assessor](https://fallax.io/compliance/cmmc.md): CMMC Level 2 requirement AT.L2-3.2.1 (NIST SP 800-171 3.2.1) is assessed objective by objective, and the DoD assessment guide names simulated phishing emails as an awareness technique and training records as something assessors examine. What Fallax produces for it.
- [NYDFS 500.14(a)(3): social engineering training evidence](https://fallax.io/compliance/nydfs.md): 23 NYCRR 500.14(a)(3) requires covered entities to give all personnel cybersecurity awareness training that includes social engineering, at least annually, updated to their risk assessment. What Fallax produces for it, and for the documentation behind the April 15 certification.
- [Integrations: Google Workspace, Microsoft 365, Vanta, Drata, Sprinto](https://fallax.io/integrations.md): Fallax connects at two points: the workspace that delivers the simulation (Google Workspace, Microsoft 365) and the compliance platform that receives the evidence (Vanta, Drata, Secureframe, Sprinto). Both are accounts you already own, an MCP server lets Claude or ChatGPT read the results, and campaign notifications post to Slack or Microsoft Teams.
- [Vanta integration: phishing evidence, synced automatically](https://fallax.io/integrations/vanta.md): Connect your own Vanta workspace and Fallax pushes per-person security awareness training evidence continuously, feeding Vanta's built-in tests across SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and CCPA.
- [Drata integration: training evidence filed per person](https://fallax.io/integrations/drata.md): Connect your own Drata workspace with an API key and Fallax files one dated security training evidence document per person per simulation, attached to their personnel record, hourly and deduplicated.
- [Secureframe integration: training evidence, filed for you](https://fallax.io/integrations/secureframe.md): Connect Secureframe with an API key pair and Fallax files a dated training PDF on each person's record after every simulation. Add a custom integration to feed Custom Automated Tests as well.
- [Sprinto integration: workflow check evidence, filed for you](https://fallax.io/integrations/sprinto.md): Connect your own Sprinto workspace with an API key, pick the workflow check your awareness programme runs under, and Fallax files a dated evidence document for every simulation: who it reached, what each person did, and the rates that came out of it.
- [Slack integration: phishing programme notifications in a channel](https://fallax.io/integrations/slack.md): Connect a Slack channel with an incoming webhook you create in your own workspace. Fallax posts when a simulation goes out, when a send fails, when someone reports one, when the programme stops, and a Monday summary. To the channel, never to a person, and never by name.
- [Microsoft Teams integration: phishing programme notifications](https://fallax.io/integrations/microsoft-teams.md): Post Fallax notifications into a Teams channel using a Workflow made from Microsoft's own webhook template. No app installed for your users, no Power Automate licence, and no notification that names a person.
- [Claude integration: Fallax as a custom connector](https://fallax.io/integrations/claude.md): Add Fallax to Claude as a custom connector over the Model Context Protocol. Twelve tools, ten of them read-only, answering from your own campaign results. Everyone signs in themselves and sees only what they could see in Fallax.
- [ChatGPT integration: Fallax as an MCP connector](https://fallax.io/integrations/chatgpt.md): Add Fallax to ChatGPT as a developer-mode MCP connector. Twelve tools, ten of them read-only, answering from your own campaign results. Everyone signs in themselves and sees only what they could see in Fallax.
- [n8n integration: phishing simulation triggers and actions](https://fallax.io/integrations/n8n.md): The Fallax node for n8n. Trigger a workflow on a reported phish, a click or a credential submit, read campaigns and results, and add or offboard people from wherever your joiners and leavers live. One workspace API key, read-only unless you say otherwise.
- [ConnectWise PSA integration: phishing simulation tickets for MSPs](https://fallax.io/integrations/connectwise.md): Fallax opens a ConnectWise service ticket against the right company when one of your clients' people clicks a phishing simulation, files the results once a run settles, and keeps each client's seat count on its agreement addition. One API member for your whole book.
- [Autotask PSA integration: phishing simulation tickets for MSPs](https://fallax.io/integrations/autotask.md): Fallax opens an Autotask ticket against the right company when one of your clients' people clicks a phishing simulation, files the results once a run settles, and keeps each client's seat count on its recurring service contract. One API user for your whole book.
- [HaloPSA integration: phishing simulation tickets for MSPs](https://fallax.io/integrations/halopsa.md): Fallax opens a HaloPSA ticket against the right client when one of their people clicks a phishing simulation, files the results once a run settles, and keeps each client's seat count on its recurring invoice. One API application for your whole book.

## Developers and agents

- [Fallax developer documentation](https://fallax.io/docs.md): Developer and agent resources for Fallax: the read-only MCP server, its OAuth discovery endpoints, Markdown content negotiation, and the machine-readable files this site publishes.
- [Fallax MCP server: connect Claude or ChatGPT](https://fallax.io/docs/mcp.md): The Fallax MCP server exposes one workspace's phishing-simulation results to Claude, ChatGPT and any other MCP client. Read-only apart from two stop controls, OAuth 2.1, no API key, and twelve tools documented here.
- [Fallax REST API](https://fallax.io/docs/api.md): The Fallax REST API: reported mail, the simulation event log, campaigns and the directory, over HTTP with one workspace API key. Cursor paging, an exclusive `since` window for pollers, and an n8n node built on it.

## Free tools

- [Free Domain Spoofing Checker: test SPF, DKIM and DMARC](https://fallax.io/tools/domain-spoofing-checker.md): Enter a domain and see in seconds whether spoofed email claiming to be you would reach inboxes. Reads SPF, DKIM and DMARC the way receivers do. Free, no signup.
- [Free BIMI Checker: will Gmail show your logo and checkmark?](https://fallax.io/tools/bimi-checker.md): Enter a domain and see whether inboxes will show its logo. Checks the BIMI record, DMARC enforcement, the SVG Tiny PS logo and the VMC or CMC certificate. Free, no signup.
- [Free BIMI SVG converter: make your logo SVG Tiny PS](https://fallax.io/tools/bimi-svg-converter.md): Convert a logo SVG from Figma, Illustrator or Inkscape to the SVG Tiny PS profile BIMI requires. Lists every change and previews the inbox crops. Runs in your browser.
- [BIMI inbox preview: your logo in Gmail, Apple Mail, Yahoo and Outlook](https://fallax.io/tools/bimi-inbox-preview.md): Check a domain or upload an SVG and see what each inbox shows: logo, initial or blue checkmark, in light and dark.
- [Which BIMI certificate can I get? VMC or CMC eligibility check](https://fallax.io/tools/bimi-certificate-wizard.md): Answer a few questions about your trademark and logo history and see which BIMI certificate you qualify for: VMC, or a CMC by prior use, modified or provisional mark. Checks archive.org for you. Free.
- [Free Email Header Analyzer: was this phishing?](https://fallax.io/tools/email-header-analyzer.md): Paste the headers of a suspicious email and see who really sent it. Reads SPF, DKIM, DMARC alignment, sender mismatches and the delivery path. Runs in your browser, nothing is uploaded.
- [Free DMARC Record Generator: build and check your policy](https://fallax.io/tools/dmarc-record-generator.md): Build the exact TXT record to publish at _dmarc, with a plain reading of every tag, the warnings that matter, and the rollout from monitoring to reject. Runs in your browser, free, no signup.
- [Free Lookalike Domain Checker: find typosquats of your domain](https://fallax.io/tools/lookalike-domain-checker.md): Enter a domain and see the look-alike domains an attacker could register to impersonate you, and which ones already exist. Homoglyphs, typos and swapped suffixes. Free, no signup.
- [Free Security Awareness Policy Generator (template)](https://fallax.io/tools/security-awareness-policy-generator.md): Answer six questions and get a security awareness policy you can adopt: training cadence, reporting, MFA, personal devices. Runs in your browser, free, no signup.
- [Spot the Phish: a free phishing quiz anyone can take](https://fallax.io/tools/spot-the-phish.md): Judge eight real-world email specimens as phishing or legitimate, get the tell on each one, and see your score. A quick, shareable way to test how well you recognise a lure. Free, no signup.
- [Free Cybersecurity Awareness Month Toolkit 2027](https://fallax.io/tools/cybersecurity-awareness-month.md): A ready-to-run plan for Cybersecurity Awareness Month this October: a four-week programme, copy-paste announcement templates, practical tips and suggested simulations. Free, no signup.

## Comparisons

- [Compare Fallax with the phishing simulation platforms](https://fallax.io/vs.md): Honest comparisons between Fallax and the main phishing-simulation platforms, including where each competitor is the better choice.
- [Phishing simulation software: the platforms compared](https://fallax.io/alternatives.md): Every serious phishing simulation and security awareness platform, described on its own terms: KnowBe4, Proofpoint, Mimecast, Cofense, SoSafe, Microsoft, Hoxhunt, Gophish and more. Pricing sourced and dated.
- [Fallax vs KnowBe4: an honest comparison](https://fallax.io/vs/knowbe4.md): The category's default, and the one big vendor that publishes a rate card. Roughly two to four times our per-seat price, with the content library as the tier lever. Compare pricing, compliance evidence and deployment, including where KnowBe4 is the better choice.
- [Fallax vs Proofpoint: an honest comparison](https://fallax.io/vs/proofpoint.md): Strongest when Proofpoint already runs your email security. Weakest as a standalone purchase. Compare pricing, compliance evidence and deployment, including where Proofpoint is the better choice.
- [Fallax vs Mimecast: an honest comparison](https://fallax.io/vs/mimecast.md): A human-risk console fed by your other security tools. Bought as part of the Mimecast platform, at a price that comes through sales. Compare pricing, compliance evidence and deployment, including where Mimecast is the better choice.
- [Fallax vs Cofense: an honest comparison](https://fallax.io/vs/cofense.md): Built around the report button and the SOC behind it. Enterprise scope, enterprise price, quoted. Compare pricing, compliance evidence and deployment, including where Cofense is the better choice.
- [Fallax vs SoSafe: an honest comparison](https://fallax.io/vs/sosafe.md): The strongest European enterprise option: 32 languages, EU hosting, certifications in hand. The price comes through a demo. Compare pricing, compliance evidence and deployment, including where SoSafe is the better choice.
- [Fallax vs Microsoft ASM: an honest comparison](https://fallax.io/vs/microsoft-attack-simulation.md): Free if every person you test already has E5 or Defender P2. Rarely free in practice. Compare pricing, compliance evidence and deployment, including where Microsoft ASM is the better choice.
- [Fallax vs Hoxhunt: an honest comparison](https://fallax.io/vs/hoxhunt.md): Adaptive, per-person training with strong engagement. Premium, quote-based pricing. Compare pricing, compliance evidence and deployment, including where Hoxhunt is the better choice.
- [Fallax vs Huntress: an honest comparison](https://fallax.io/vs/huntress.md): Managed for you, with a published per-learner price and a 50-learner minimum when bought direct. Compare pricing, compliance evidence and deployment, including where Huntress is the better choice.
- [Fallax vs Phished: an honest comparison](https://fallax.io/vs/phished.md): Automation-first and European, with one behavioural score as the headline number. The price still comes through a demo. Compare pricing, compliance evidence and deployment, including where Phished is the better choice.
- [Fallax vs usecure: an honest comparison](https://fallax.io/vs/usecure.md): One bundle covering training, phishing, policies and breach monitoring, built for MSP margin. The rate is still a conversation. Compare pricing, compliance evidence and deployment, including where usecure is the better choice.
- [Fallax vs Riot: an honest comparison](https://fallax.io/vs/riot.md): Seven modules for one published price, and roughly eight times our rate if simulations are the part you use. Compare pricing, compliance evidence and deployment, including where Riot is the better choice.
- [Fallax vs CanIPhish: an honest comparison](https://fallax.io/vs/caniphish.md): The one platform whose published price undercuts ours. The difference is what your mail gateway has to be told to let through. Compare pricing, compliance evidence and deployment, including where CanIPhish is the better choice.
- [Fallax vs Keepnet: an honest comparison](https://fallax.io/vs/keepnet.md): The most transparent rate card in the category and the nearest list price above ours. The tiers are where the modules live. Compare pricing, compliance evidence and deployment, including where Keepnet is the better choice.
- [Fallax vs Wizer: an honest comparison](https://fallax.io/vs/wizer.md): A good free video library. The phishing simulation is in the paid plan, on a three-year term. Compare pricing, compliance evidence and deployment, including where Wizer is the better choice.
- [Fallax vs PhishingBox: an honest comparison](https://fallax.io/vs/phishingbox.md): Published tiers and no seat minimum. The LMS, the API and the triage inbox each sit one rung further up. Compare pricing, compliance evidence and deployment, including where PhishingBox is the better choice.
- [Fallax vs Sophos: an honest comparison](https://fallax.io/vs/sophos-phish-threat.md): Sensible if Sophos Central is already open on someone's screen. A whole console to adopt if it is not. Compare pricing, compliance evidence and deployment, including where Sophos is the better choice.
- [Fallax vs Barracuda: an honest comparison](https://fallax.io/vs/barracuda.md): Priced as part of an email security suite. Excellent if you wanted the suite, expensive if you wanted the training. Compare pricing, compliance evidence and deployment, including where Barracuda is the better choice.
- [Fallax vs Guardey: an honest comparison](https://fallax.io/vs/guardey.md): A well-made European training habit in nine languages. Getting the simulations and the training means buying the top plan. Compare pricing, compliance evidence and deployment, including where Guardey is the better choice.
- [Fallax vs MetaCompliance: an honest comparison](https://fallax.io/vs/metacompliance.md): Strong content and 40-plus languages, sold the enterprise way: a demo, a quote and an implementation project. Compare pricing, compliance evidence and deployment, including where MetaCompliance is the better choice.
- [Fallax vs Gophish: an honest comparison](https://fallax.io/vs/gophish.md): Free and capable at sending and tracking. Everything around it is your job, and the last release was in 2022. Compare pricing, compliance evidence and deployment, including where Gophish is the better choice.

## Blog

- [Blog: product, research and engineering at Fallax](https://fallax.io/blog.md): What we ship, what we find when we measure email security at scale, and the engineering decisions behind the phishing-simulation platform.
- [ClickFix simulations](https://fallax.io/blog/clickfix-fake-captcha.md): Fallax now runs ClickFix simulations: a fake "verify you are human" page that asks staff to paste and run a command. The command is a harmless beacon, so you see per person who ran it, and they land on a short lesson right after. On by default in the continuous programme.
- [When the reply is the compromise](https://fallax.io/blog/business-email-compromise-reply-tracking.md): Business email compromise has no link to click and no page to submit, so a simulator that only scores clicks scores zero on the attack that costs companies the most. Fallax now ships a BEC lure pack and tracks the reply itself as the outcome, through the mailbox it already reads.
- [DMARCbis and BIMI: what RFC 9989 changes for your logo](https://fallax.io/blog/dmarcbis-bimi.md): RFC 9989 replaced DMARC's RFC 7489 in May 2026. It drops pct and adds t=y, np and a DNS tree walk. The BIMI draft still points at the old RFC. Which records still get a logo, and the t=y record that quietly loses it.
- [BIMI: how to get your logo and the blue checkmark in Gmail](https://fallax.io/blog/bimi-gmail-checkmark.md): Gmail shows your logo with a CMC and adds the blue checkmark only with a VMC, and both need DMARC at enforcement first. What each step takes, what the certificates cost, and what Apple Mail, Yahoo and Outlook do with it.
- [Fallax now works with ConnectWise, Autotask and HaloPSA](https://fallax.io/blog/psa-integration-connectwise-autotask-halopsa.md): One PSA connection for every client on your invoice. A ticket when somebody clicks, a results ticket when a run settles, and each client's seat count kept on its billing line.
- [Which PCI DSS SAQs require security awareness training?](https://fallax.io/blog/pci-dss-saq-security-awareness-training.md): SAQ A has none. B, B-IP, P2PE and SPoC ask for a programme. A-EP, C and C-VT add phishing and social engineering under 12.6.3.1. SAQ D asks for all of it, every 12 months. Per SAQ, with what an assessor checks and what to have ready.
- [NIS2 training: the board is in scope, and the spec is already written](https://fallax.io/blog/nis2-security-awareness-training.md): Article 21(2)(g) is seven words. A Commission regulation and an ENISA guide say what they mean, and Article 20 puts your board in the room. Where it all stands in September 2026.
- [Microsoft 365 advanced delivery policy: what it switches off](https://fallax.io/blog/advanced-delivery-policy-phishing-simulation.md): Every phishing simulator that sends mail asks you to put its domain and IP on one tab in Defender. This is what that tab switches off, why any domain on it pairs with any IP on it, and how to check what is still sitting there.
- [Our n8n node is live](https://fallax.io/blog/n8n-node-live.md): A trigger for reported phish, clicks and credential submits, an action node for the directory, and a key that cannot send a simulation. In n8n Cloud's nodes panel, or one package name on self-hosted.
- [Is Gophish still maintained? Spoiler: barely.](https://fallax.io/blog/is-gophish-still-maintained.md): Last release September 2022, last commit September 2024, and a high-severity CVE from December 2024 with no fixed version to upgrade to. What that means if you run it.
- [Security questionnaires: how to answer the awareness training question](https://fallax.io/blog/security-questionnaire-awareness-training.md): Every B2B security questionnaire asks whether you train your staff and run simulated phishing. A one-line yes always comes back as a follow-up a day or two later. Here is what the person reading your answer actually needs from it, and the four facts that give it to them.
- [Our MCP server is in the official registry](https://fallax.io/blog/mcp-server-official-registry.md): Paste one URL into Claude or ChatGPT and ask how the phishing programme is going. Twelve tools, ten of which only read, none of which can send a simulation, and no API key to issue or rotate.
- [A Report phishing button for Gmail, on the Workspace Marketplace](https://fallax.io/blog/gmail-report-phishing-button.md): Fallax is now on the Google Workspace Marketplace. One install puts a Report phishing button next to every message in Gmail, and pressing it credits the report while the person is still looking at the mail.
- [mailgrade: our SPF, DKIM and DMARC library is now open source](https://fallax.io/blog/mailgrade-open-source.md): The code behind the three free email tools on this site is on npm, MIT licensed. Zero dependencies, no Node built-ins in the core, and a language-neutral corpus of 160 cases so that a port to another language is a weekend rather than a rewrite.
- [We do not email our phishing simulations](https://fallax.io/blog/we-do-not-email-our-phishing-simulations.md): Every phishing simulator which mails your staff from the outside will at some point ask you to weaken your own filtering, so that the test survives the trip. We write the message directly into the mailbox instead. Here is how that works, and what it costs you.
- [What is a good phishing click rate? The 2026 benchmarks](https://fallax.io/blog/phishing-click-rate-benchmarks.md): Verizon puts the median click rate for an email phishing simulation campaign at 1.4%. Across fifteen months at one company, 32.1% of employees clicked at least one. Here are the published benchmarks, from sources that are not selling awareness training, and how to work out which number your board should be looking at.
- [Phishing simulation examples, ranked by what makes a lure work](https://fallax.io/blog/phishing-simulation-examples.md): Twenty simulated phishing emails from two published studies, rated on NIST's premise alignment scale. The best lure fooled nineteen times as many people as the worst, and the design quality had nothing to do with it.
- [ISO 27001 security awareness training: the A.6.3 evidence auditors accept](https://fallax.io/blog/iso-27001-security-awareness-training.md): Annex A control 6.3 is four lines long and it is not asking you to buy training. It is asking you to prove a period. Here is what the clause requires, why annual modules fail on the same gap every time, and the four artefacts that close it.

## Optional

- [About Fallax](https://fallax.io/about.md): Why we built Fallax: phishing simulation and awareness training with the price on the site, the evidence export on the free plan, and everything hosted in the EU.
- [Careers at Fallax](https://fallax.io/careers.md): Open roles at Fallax, the teams we hire into, and how hiring works. The open application stays open whether or not anything is posted.
- [Fallax brand and press kit](https://fallax.io/press.md): Fallax logos in SVG and PNG, the palette, the rules for using the mark and the name, boilerplate you can paste, and the company facts a story needs.
- [Contact Fallax](https://fallax.io/contact.md): How to reach Fallax: one address for sales, support, security reports, GDPR requests and contracts, read by the people who can actually answer.
- [Fallax Trust Center](https://fallax.io/trust.md): Fallax's security and compliance posture: frameworks, security controls, resources and sub-processors.
- [Fallax status](https://fallax.io/status.md): Live status of the Fallax app, API, landing pages and mailbox delivery, with 90 days of uptime and every incident we have declared.
- [Fallax Privacy Notice](https://fallax.io/privacy.md): What personal data Fallax processes, why, for how long, and the rights of the people in a customer's directory.
- [Fallax Terms of Service](https://fallax.io/terms.md): The agreement covering use of Fallax, including the authorised-use rule that governs running simulations against your own people.
- [Fallax Data Processing Agreement](https://fallax.io/dpa.md): The DPA Fallax offers as processor, with the annexes describing processing, security measures and sub-processors.
- [KnowBe4 alternatives: what to switch to and why](https://fallax.io/alternatives/knowbe4.md): Why teams leave KnowBe4, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Proofpoint alternatives: what to switch to and why](https://fallax.io/alternatives/proofpoint.md): Why teams leave Proofpoint, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Mimecast alternatives: what to switch to and why](https://fallax.io/alternatives/mimecast.md): Why teams leave Mimecast, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Cofense alternatives: what to switch to and why](https://fallax.io/alternatives/cofense.md): Why teams leave Cofense, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [SoSafe alternatives: what to switch to and why](https://fallax.io/alternatives/sosafe.md): Why teams leave SoSafe, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Microsoft ASM alternatives: what to switch to and why](https://fallax.io/alternatives/microsoft-attack-simulation.md): Why teams leave Microsoft ASM, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Hoxhunt alternatives: what to switch to and why](https://fallax.io/alternatives/hoxhunt.md): Why teams leave Hoxhunt, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Huntress alternatives: what to switch to and why](https://fallax.io/alternatives/huntress.md): Why teams leave Huntress, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Phished alternatives: what to switch to and why](https://fallax.io/alternatives/phished.md): Why teams leave Phished, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [usecure alternatives: what to switch to and why](https://fallax.io/alternatives/usecure.md): Why teams leave usecure, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Riot alternatives: what to switch to and why](https://fallax.io/alternatives/riot.md): Why teams leave Riot, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [CanIPhish alternatives: what to switch to and why](https://fallax.io/alternatives/caniphish.md): Why teams leave CanIPhish, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Keepnet alternatives: what to switch to and why](https://fallax.io/alternatives/keepnet.md): Why teams leave Keepnet, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Wizer alternatives: what to switch to and why](https://fallax.io/alternatives/wizer.md): Why teams leave Wizer, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [PhishingBox alternatives: what to switch to and why](https://fallax.io/alternatives/phishingbox.md): Why teams leave PhishingBox, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Sophos alternatives: what to switch to and why](https://fallax.io/alternatives/sophos-phish-threat.md): Why teams leave Sophos, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Barracuda alternatives: what to switch to and why](https://fallax.io/alternatives/barracuda.md): Why teams leave Barracuda, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Guardey alternatives: what to switch to and why](https://fallax.io/alternatives/guardey.md): Why teams leave Guardey, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [MetaCompliance alternatives: what to switch to and why](https://fallax.io/alternatives/metacompliance.md): Why teams leave MetaCompliance, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.
- [Gophish alternatives: what to switch to and why](https://fallax.io/alternatives/gophish.md): Why teams leave Gophish, the four platforms they shortlist instead, and what to check before switching. Pricing sourced and dated.