Scarlet Risk · Tool guide
Phishing simulation for small businesses and MSPs
A phishing simulation is an authorized email test that helps a team see how it responds to a suspicious message. Scarlet Risk turns your company name, industry, selected difficulty, and recipient list into an AI-written campaign, then records delivery and link-click results from that campaign. It is a focused security-awareness tool, not an assessment of every employee’s overall cyber risk.
What happens during a phishing test?
Sign in, purchase a campaign pack, and add the employees you are authorized to test. Enter recipients individually or import a CSV, then choose easy, medium, or hard difficulty. Easy uses more obvious warning signs; medium uses a plausible internal request; hard uses a targeted, senior-staff pretext. A campaign accepts up to 200 recipients.
When you launch, the tool generates and sends the simulated email. A recipient who follows its tracking link reaches a debrief page explaining that it was a simulation and describing warning signs to look for next time. The test does not collect passwords or other credentials.
What your campaign results show
The results view brings the campaign subject, company, industry, difficulty, and date together with a per-recipient table. You can review delivery status, recorded clicks, and click timestamps, then use the print option to save the results as a PDF for your security-awareness records.
- Recorded delivery status and any delivery error for each recipient.
- The number of recipients with recorded clicks in the campaign.
- A dated record you can review alongside your training and reporting process.
Using simulation results as compliance evidence
A campaign record can support a discussion about security-awareness activity with a customer, insurer, or auditor. It does not certify compliance or prove that someone who did not click recognized the threat. Read click results alongside delivery status and the circumstances of the test; a failed delivery is not a successful employee response.
Use the findings to decide where follow-up training is needed rather than treating the report as a disciplinary score. The current Store tool runs campaigns you launch yourself. Scheduled campaigns and automatic retraining are not included in this version.
Campaign packs and account access
The existing pack includes five campaigns for $49 as a one-off purchase, with no subscription required. Unused campaigns do not expire. Campaigns and results are tied to your account. Only test an organization’s employees when you have permission to do so; the tool is not intended for unsolicited tests against third parties.