🎯 Sherlocked Security – Managed Phishing Simulation Service
Train. Test. Transform – One Click at a Time.
📄 1. Statement of Work (SOW)
Service Name: Managed Phishing Simulation & Awareness Assessment
Client Type: Enterprises, Government Agencies, Financial Institutions, Healthcare Providers
Service Model: Fully Managed Campaigns + Awareness Reporting + Resilience Training
Compliance Coverage: NIST 800-53, ISO/IEC 27001, GDPR (Training & Awareness), PCI DSS
Testing Types:
- Credential Harvesting & Fake Login Pages
- Attachment-Based Malware Simulation
- Business Email Compromise (BEC) Scenarios
- Spear Phishing with Custom Context
- Link-Based Drive-by Attacks (non-malicious)
- SMS & Voice Phishing Simulation (SMiShing & Vishing)
- Internal Lateral Phishing Tests
🧠 2. Our Approach (with Visual)
🎣 Craft. Simulate. Analyze. Educate.
AI Visual Flow:
[Target Group Setup] → [Phishing Scenario Design] → [Email/SMS/Vishing Execution] → [Engagement Tracking] → [Awareness Metrics] → [Training & Recommendations]
Color Code:
- Simulation Engine: #0d47a1
- Tracking & Metrics: #33691e
- Awareness Training: #bf360c
🧪 3. Methodology (with Visual)
[Target Identification] → [Phishing Vector Selection] → [Email Template Customization] → [Simulation Execution] → [Interaction Capture] → [Metrics Dashboard] → [Training Push] → [Final Report]
Visual Flow Phases:
- ✉️ Email/SMS Channel (Phish Delivery)
- 🧠 User Interaction Layer (Click/Submit Behavior)
- 📊 Reporting Layer (Stats & Insights)
📦 4. Deliverables to the Client
- 📬 Phishing Simulation Summary Report
- 📊 User Interaction Metrics (Open, Click, Submit)
- 🧠 Awareness Gaps Analysis & Recommendations
- 🎥 Campaign Replay (Screenshots, Flow Trail)
- 🧪 Attack Simulation Sample Artifacts (e.g., fake login page, spoofed sender)
- 🧾 Compliance-Mapped Awareness Report
- 🏆 Human Firewall Readiness Scorecard
- 🧰 Optional: Follow-up Training Content Pack
🤝 5. What We Need from You (Client Requirements)
- ✅ Employee email addresses (or user groups)
- ✅ Approved testing windows
- ✅ Consent from HR / Legal / Security Teams
- ✅ Optional: Company branding/logo for realism
- ✅ Access to internal communication policies (to avoid alert overlap)
🧰 6. Tools & Technology Stack
- ✉️ Email Phishing Tools: GoPhish, King Phisher
- 🎣 Phishing Kit Builders: Evilginx2, CredSniper
- 🕵️ Custom Payload Generators
- 📊 Analytics Dashboard: Grafana, ELK Stack
- 📱 SMiShing/Vishing Tools: Custom scripts, Twilio, Asterisk
- 🎓 Awareness Training Portals: KnowBe4-style modules (customizable)
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Requirement Gathering → 2. Campaign Design → 3. Scenario Customization → 4. Simulation Execution → 5. Result Analysis → 6. Awareness Push → 7. Final Report Delivery
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 🎣 Realistic & Customized Scenarios | Crafted from real-world incidents & threat intel |
| 📊 Actionable Metrics | Clear insights into user behavior under simulated stress |
| 🔁 Retest Ready | Repeat simulations to measure resilience over time |
| 🧠 Integrated Awareness Training | Educate users immediately after testing |
| 📋 Policy-Aligned Campaigns | Compliant with HR, IT & legal frameworks |
📚 9. Real-World Case Studies
💼 CFO Impersonation Attempt (BEC)
Test: Simulated a wire transfer request from fake CFO domain
User Response: Opened email and replied with partial internal information
Impact: Highlighted lack of verification protocol
Fixes: CFO-auth email awareness training & multi-approval finance policy
🏥 Healthcare HR Phish
Test: Fake HR benefits update with credential phishing page
User Response: 32% clicked, 15% entered credentials
Impact: Credentials could’ve enabled lateral movement
Fixes: Monthly awareness training + MFA enforcement reminder
🛡️ 10. SOP – Standard Operating Procedure
- Stakeholder kickoff & scoping
- Target list and campaign type finalization
- Email/SMS/phishing template development
- Controlled simulation launch
- Monitoring & behavior tracking
- Awareness push for triggered users
- Report creation with heatmap & metrics
- Optional retest & training integration
📋 11. Sample Phishing Simulation Checklist (Preview)
- Identify user groups to be tested
- Define phishing vectors (email, SMS, voice)
- Ensure internal policy alignment and approvals
- Design realistic templates and payloads
- Test email deliverability (anti-spam bypass)
- Track opens, clicks, and data submissions
- Capture behavioral patterns and report anomalies
- Assess training effectiveness post-campaign
- Run follow-up simulations for comparison
- Provide strategic user awareness insights