Phishing simulation software
Phishing simulation for teams in France and the EU
nophi.sh sends your staff realistic fake phishing emails in French or English, measures who opens, clicks or types a password, and assigns short training to the people who were caught. The platform and its data are hosted in France.
- 80 ready-made scenarios, each in French and English
- First campaign the same day, about 15 minutes of setup
- Flat price per plan from €99/month excl. VAT, not per user
- 14-day trial of the full product, no credit card, no charge at the end
In short
A phishing simulation is a fake phishing email sent to your own staff to measure and train their reflexes. If you have employees in France, two things matter more than elsewhere: lures that look like what French inboxes actually receive, and a rollout that respects French labour law (staff informed, works council consulted, no sanctions). This page covers how a campaign runs, what you measure, the legal points, pricing, and how nophi.sh compares with GoPhish, KnowBe4 and Microsoft.
Who it is for
Built for companies with staff in France
nophi.sh started as a tool for French SMEs, and that shapes the product. It fits you if you are:
- A French company, or the French subsidiary of an international group, that needs campaigns in French.
- A European company with a mixed team where some people read French and others English.
- An IT service provider running awareness programmes for several client organisations from one account.
- An organisation that wants its awareness data hosted in France under GDPR, with a French supplier.
Phishing is still the most common way in. In France, 55% of significant attacks on companies start with a phishing email (CESIN barometer, 2026). Worldwide, the human element is involved in 62% of breaches (Verizon DBIR 2026).
How it works
How a campaign runs
- 1
Import the people you want to test
From a CSV file or by syncing Microsoft 365 / Entra ID. Each person belongs to a department and has a manager, so results can be read team by team.
- 2
Allow-list the sending servers
Declare the nophi.sh sending servers in Microsoft 365 or Google Workspace so simulations are not filtered as spam. This is the most technical step; the documentation gives the exact settings.
- 3
Pick a scenario
From the library, or write your own template. Every scenario has an easy, medium or hard version.
- 4
Schedule and spread the sends
By default emails go out Monday to Friday between 9:00 and 17:00, spread over time so colleagues do not warn each other all at once.
- 5
Train at the moment of the mistake
Anyone who clicks lands on a page that shows the signs they missed. A training course can be assigned automatically, with reminders.
- 6
Retest by risk level
Autopilot retests each person every 7, 14 or 30 days depending on their risk score. Repeat clickers see more simulations; reliable reporters see fewer.
Expect about 15 minutes of setup before the first campaign, not counting allow-listing in your email system. It can go out the same day.
Scenario library
80 scenarios, each in French and English
A fake IRS notice will not fool anyone in Lyon, and a fake Chronopost delivery notice means nothing in Leeds. Each nophi.sh scenario exists in both languages, so a mixed team gets the lure that fits their inbox. The library covers 16 categories, including:
CEO and supplier fraud
Urgent transfer requests, changed bank details, invoices to pay.
Microsoft 365 and collaboration
Expired password, SharePoint share, Teams message, DocuSign signature request.
IT support and HR
Mandatory update, new remote-work policy, payslip available.
Everyday services
Parcel delivery, tax authority, telecom provider, full cloud storage.
Links can lead to a fake Microsoft 365, Google Workspace or generic login page. Passwords typed there are never stored: nophi.sh only records that a submission happened. You can also write your own templates, for example from a real fraud attempt your finance team received. Simulations are email only: no SMS or QR-code scenarios today.
Legal
Is phishing simulation legal in France?
Yes, when it is used for training and staff know the programme exists. If you are rolling out a group-wide programme, check these points for your French entities:
- Employees must be informed. The French Labour Code (article L1222-4) forbids collecting information about an employee through a system they have not been told about. Announce that phishing exercises will happen; you do not have to give dates or scenarios.
- Where there is a works council (CSE), it must be informed and consulted before a tool that can monitor employee activity is introduced (article L2312-38).
- Named results are personal data. The usual legal basis is the employer's legitimate interest in securing its systems (GDPR article 6(1)(f)). Record it, collect only what you need, set a retention period.
- Put the exercises in your IT policy and commit in writing not to discipline anyone for a click. People who fear punishment stop reporting.
nophi.sh data is hosted in France by Nextmap, a French operator running its own network, and deleted 30 days after the contract ends. This is general guidance, not legal advice; check with your lawyer or DPO.
Results
What you measure
The dashboard follows the whole path: email opened, link clicked, credentials submitted, and email reported. You can read the results:
- By department and by manager team, to find the exposed teams (finance, purchasing, executives).
- For repeat clickers, and for people who have never been tested.
- For overdue training, with automatic reminders and then escalation to the manager.
- As a risk score per person and a posture score for the organisation, tracked over time.
To report, employees forward the suspicious email to the nophi.sh address, or use the built-in Microsoft 365 Report button configured to send there. They get the AI verdict and its reasons back, usually in under a minute. The same works for real suspicious emails: see AI detection.
Everything exports to CSV and to a PDF audit report (executive summary, trends, risk distribution, departments, training completion). You can use it as evidence of awareness training for your insurer or for your own NIS2, ISO 27001 (A.6.3) or DORA audits. On its own it does not cover everything those frameworks require.
For context: the KnowBe4 Phishing by Industry Benchmarking Report 2025 measured an average click rate of 33.1% before training and 4.1% after twelve months, across KnowBe4 customers. Those are KnowBe4's figures, not nophi.sh results. Our article on click-rate benchmarks by industry compares several sources.
See your own numbers after one campaign
Import a team and pick a scenario: the campaign can go out today, on the 14-day trial.
After the click
Training that follows the click
Right after a click, people pay attention. The landing page takes about 3 minutes to walk through what should have raised a flag in that specific email. Rules you set (by scenario category or by action) then assign a course, with reminders on day 3 and day 6 and a note to the manager if nothing happens.
- A built-in course, "Phishing awareness: the fundamentals": 5 lessons and a 10-question quiz (80% to pass), in French and English.
- A course builder for your own content, such as your payment procedure or internal rules.
- 40 knowledge-base articles (20 in French, 20 in English) and a public spot-the-phish game.
Pricing
Pricing
Each plan has a flat price; you do not pay per user. Starter covers up to 50 users for €99 per month excluding VAT, with 20% off when paid annually. Larger plans and the custom Enterprise offer are on the pricing page.
For larger organisations, Enterprise adds on request single sign-on with your identity provider, custom training content, assisted onboarding, and scenarios built from the attacks you actually received. The trial runs 14 days with the full product, no credit card, and nothing is charged when it ends.
Alternatives
nophi.sh, GoPhish, KnowBe4 or Microsoft Attack Simulation Training?
| nophi.sh | GoPhish | KnowBe4 | Microsoft Attack Simulation Training | |
|---|---|---|---|---|
| Type | Hosted platform, data in France | Open-source software you host yourself | Hosted platform, US vendor | Part of Microsoft Defender for Office 365 |
| Price | From €99/month excl. VAT, flat per plan | Free software, plus server and admin time | On quote, per user | Included in M365 E5 or Defender for Office 365 Plan 2 (per-user licences) |
| Scenarios included | 80, in French and English | None, you write them | 6,000+ templates, 35 languages | "40+ localized payloads in 29+ languages" |
| Training after a click | Yes, assigned automatically | No | Yes, large catalogue | Yes |
| Best for | SMEs and mid-size companies without a dedicated security team | Technical teams, one-off tests | Large international organisations | Organisations already licensed for E5 or Plan 2 |
Figures published by the vendors, checked in 2026. Detailed comparisons (in French): GoPhish, KnowBe4, Attack Simulation Training.
When to pick something else. If you need SMS, QR-code or voice simulations, nophi.sh does not do them today. If your staff work in twenty languages, KnowBe4 has the larger catalogue. If you already pay for Microsoft 365 E5, start with the tool you have. And if you have technical time and a one-off need, GoPhish will do the job.
Frequently asked questions
What is a phishing simulation?
A fake phishing email sent to your own employees, in an announced programme, to measure who clicks or enters credentials and to train those people straight away. Repeated over time, it lowers the click rate and raises the number of reports.
Can we run simulations in French and English at the same time?
Yes. Every scenario in the library exists in both languages, and notification emails can be edited in French and English.
Do we need to tell employees in France before a simulation?
You need to tell them the programme exists (French Labour Code, article L1222-4), not the date of each campaign. Where there is a works council (CSE), consult it before rollout.
Are the passwords entered on the fake page stored?
No. nophi.sh records that a submission happened, never what was typed.
Can we sync users from Google Workspace or Active Directory?
Not today. Users come from a CSV import or from Microsoft 365 / Entra ID sync. Google Workspace and on-premises AD sync are not available.
Where is the data hosted?
In France, by Nextmap, a French operator running its own network. After the contract ends, data is kept for 30 days and then deleted.
Can an IT provider manage several client organisations?
Yes. One account can access several organisations, each with its own logo, colours and sender name, and four roles (owner, admin, member, viewer).
Run your first simulation this week
Fourteen days with the full product. Questions first? Thomas, our security engineer, answers by email.
No credit card. Nothing is charged when the trial ends.