What nophi.sh does, feature by feature
Fake phishing emails to test your teams, a short lesson for whoever clicks, and an AI assistant to forward doubtful emails to. Scenarios in French and English for teams in France and across Europe.
A cycle that runs on its own
Fake emails go out, whoever clicks gets trained, and autopilot retests the people at risk more often.
Simulate
Launch realistic phishing campaigns that test your teams' real reflexes.
Train
An employee falls for it? They get immediate micro-training, targeted to the exact mistake they just made.
Measure
Track click rate, reports and risk score by department and by team. Adjust your scenarios.
First campaign the same day
80 ready-made scenarios in French and English across 16 themes: CEO fraud, supplier bank-detail changes, invoices, Microsoft 365, DocuSign, deliveries, tax. You can also write your own.
Realistic scenarios
Fake DocuSign, CEO fraud, fake Microsoft 365 alerts. A library we add to regularly, and templates you can edit.
Email today
Simulations are sent by email. SMS is planned but not available yet.
Automatic campaigns
Sends spread over several days, during working hours (Monday to Friday, 9am to 5pm by default). Nothing to relaunch every week.
Signature requise - Facture #F-2847
La facture #F-2847 de TECH SOLUTIONS LTD nécessite votre signature électronique avant le 25 mars 2026.
Propulsé par DocuSign • Ne pas répondre
Virement urgent - confidentiel
Bonjour,
Je suis en réunion et ne peux pas appeler. Peux-tu traiter un virement de 12 400 € vers le compte de notre nouveau prestataire ? C'est urgent, la deadline est cet après-midi.
Je t'envoie le RIB en pièce jointe. Merci de ne pas en parler aux autres pour le moment, c'est confidentiel.
Cordialement,
Pierre Durand
Action requise : mot de passe expiré
Votre mot de passe pour j.martin@votre-entreprise.fr a expiré. Votre compte sera désactivé dans 24 heures si aucune action n'est prise.
Microsoft Corporation, One Microsoft Way, Redmond WA 98052
Suspicious email? Forward it.
An employee is unsure about an email? They forward it to your company's nophi.sh address, or use the Microsoft 365 Report button set up to send there. The verdict and its reasons come back by email, usually in under a minute.
A verdict, usually in under a minute
The AI checks the sender, links and attachments, then labels the email: phishing, suspicious or legitimate.
Forwarding an email is enough
Everyone knows how to forward an email. No add-in to install in the mail client. The assistant does not filter or block any email.
The employee learns why
The AI explains: "domain created 3 days ago", "link redirects to unknown site". Employees learn by checking.
Numbers your leadership and insurer actually understand
Click rate, reports, risk score by department and by team. Export the PDF report or the data as CSV.
3 minutes of training, right when they fail
An employee clicks a fake email? They immediately see a short explanation of the mistake they just made, instead of a 45-minute module three weeks later.
3 minutes to understand
A debrief page right after the click, on the signs they missed. The full course (5 lessons, 10-question quiz) is then assigned automatically.
Assignment rules
Choose which course to assign based on the scenario theme and the action (click or submitted password). Reminders on day 3 and day 6, then the manager is alerted.
At the right moment
The explanation appears right after the mistake, while the email is still fresh in mind.
Your own content
A course builder for your internal rules, and 40 knowledge-base articles (20 in French, 20 in English).
First campaign the same day
About 15 minutes of setup: import staff by CSV or sync Microsoft 365 / Entra ID, pick a scenario, launch. You also need to allow-list nophi.sh in your email system, a step your IT provider knows well.
About 15 minutes
CSV import or Microsoft 365 / Entra ID sync. Allow 15 minutes of setup, plus allow-listing in your email system.
Nothing to install
Everything runs in the browser. Nothing to install on workstations.
Autopilot mode
Once set up, autopilot retests each person based on their risk level (every 7, 14 or 30 days). You get the results.
Frequently asked questions
How long does it take to deploy nophi.sh?
Is phishing simulation legal in France?
What is the difference between phishing simulation and traditional training?
How does nophi.sh comply with GDPR?
Where do your teams stand? Find out after the first campaign
About 15 minutes of setup. First campaign the same day.
No credit card, nothing charged when the trial ends
