Your staff will get a phishing email. Better if it's ours.
Phishing simulations in French and English, and a short lesson after every click. Built for companies with 50 to 500 staff and teams in France or across Europe. You see who clicks and who improves, and you keep the evidence for your audits.
14 days free · no credit card · from €99/month excl. VAT
Between the click and the wire transfer: 4 hours
Your accountant opens a "DocuSign validation" link. The address: docu-sign@notif-secure.com.
The attacker is in your CFO's mailbox.
€47,000 lands in a foreign account. The bank details looked like your usual supplier's.
Your insurer denies the claim. No proof your employees were trained.
A fictional scenario, based on common fake-supplier fraud. In France, 55% of significant attacks start with phishing (CESIN barometer, 2026).
nophi.sh is a phishing simulation and security awareness platform for companies with teams in France and across Europe: it sends realistic fake phishing emails in French and English, trains the people who click, and gives you a dashboard to track human risk. Data is hosted in France.
What the numbers say
55%
of significant attacks
on French companies start with phishing.
Source: CESIN barometer, 2026
57%
of French SMEs
suffered at least one cyberattack in the last 12 months.
Source: Hiscox, 2025
62%
of data breaches
involve the human element, such as a click on a malicious link.
Source: Verizon DBIR, 2026
Three steps, then autopilot
Import your team
CSV import or Microsoft 365 / Entra ID sync. About 15 minutes of setup.
Turn on autopilot
You configure once. nophi.sh sends varied scenarios during working hours and retests people at risk more often. Fake WeTransfer, fake supplier follow-up, fake message from the CEO.
Those who click get a short lesson
3 minutes on the mistake they just made, then a course to complete, with reminders. You track progress by department in the dashboard.
Your team's new reflex
Unsure about an email? Instead of clicking, your employees forward it to nophi.sh or use the Microsoft 365 Report button. The verdict usually comes back in under a minute: phishing, suspicious or legitimate, with the reasons.
If it is phishing, your security contacts are alerted.
The assistant answers your team's doubts. It does not filter or block any email.
Try it with your team this week
14-day free trial, no credit card. Data hosted in France.
What you see in the dashboard
Screenshots of the app.
Risk score
One score for the company and one per person. Repeat clickers and overdue training show up first.
Click rate, month by month
Accounting, sales, management: who clicks, who improves, who hasn't been tested yet.
Campaign activity
Autopilot retests each person based on their risk level (every 7, 14 or 30 days), during working hours.
What the KnowBe4 2025 benchmark shows
33.1%
Average click rate on a simulated phishing email before training, all industries.
4.1%
After 12 months of regular training and simulations.
Source: KnowBe4, Phishing by Industry Benchmarking Report 2025. Industry figures published by KnowBe4; they do not describe nophi.sh customers.
Awareness evidence for your audits
NIS2, ISO 27001 (control A.6.3) and DORA all ask you to train staff on security. nophi.sh keeps a dated record of every campaign and every course.
The PDF report covers campaign history, results by department and completed training. It is one piece of your audit file: the rest of your obligations (risk management, incident handling, backups) stays on your side.
- 01 Executive summaryPosture score and campaigns for the period, for management
- 02 TrendsOpens, clicks and submitted passwords, month by month
- 03 Risk distributionNumber of people per risk level
- 04 DepartmentsResults and progress per department
- 05 TrainingCourses assigned, completed and overdue
Illustration. Contents depend on your campaigns.
Article 21: cybersecurity training for staff
Control A.6.3: awareness, education and training
ICT risk awareness for staff
A flat price per plan, with no per-user fee
Unlimited simulations, automated training and the dashboard in every plan. Prices exclude VAT.
Starter is €79.20/month billed annually for 50 employees, about €1.6 per employee per month. Most tools on the market charge €5 to €12 per user per month.
Starter
Up to 50 users
billed €950.40 per year excl. VAT billed monthly, cancel anytime
Nothing charged when the trial ends
Pro
Up to 200 users
billed €2,390.40 per year excl. VAT billed monthly, cancel anytime
Nothing charged when the trial ends
14-day trial with all features. No credit card, nothing charged at the end.
Questions your management will ask
Are we allowed to test our employees?
Yes, as long as you tell them. Inform employees and, in France, the works council (CSE) that an awareness program exists, without announcing campaign dates. Under the GDPR the processing rests on legitimate interest. Results are used to train people and should not be used to sanction them.
How much IT time does it take?
About 15 minutes of setup: import your staff (CSV or Microsoft 365 / Entra ID sync) and pick a scenario. The one technical step on top is allow-listing nophi.sh in your email system so simulations reach the inbox. Thomas can walk your IT provider through it.
How will our teams react?
Better when the program is announced as a team exercise, for example with a message from management before the first campaign. Whoever clicks sees a short explanation of the signs they missed, then gets a course to complete, with reminders.
Where is our data?
In France, with Nextmap, a French operator that runs its own network (AS35426). Passwords typed into the fake login pages are never stored. A data processing agreement (DPA) is available on request.
Your first campaign can go out today
About 15 minutes of setup, plus allow-listing in your email system. 14 days free, no credit card.
Data hosted in France
