AI writes the perfect phish. Your team spots it anyway.
Lureproof sends realistic practice phishing to your team every month. Anyone who clicks gets a 60-second lesson on the spot. You get proof they're getting sharper. Two-click setup on Google Workspace or Zoho — Microsoft 365 coming soon.
Free for 5 people · No sales calls · Cancel anytime
inbox — practice mode● live demo
Gotcha. You just clicked the lure.In real life, this is where card details get stolen. On Lureproof, it's where a 60-second lesson starts. Find the other flags →
Parcel Delivery Service<redelivery@parcel-rebook.co> ①
To: you@company.co.uk
Action required: your parcel is on hold (£1.99 fee)
Dear Customer, ②
We attempted to deliver your parcel today but were unable to because an unpaid shipping fee of
£1.99 ③
is due.
Your parcel will be returned to sender
within 24 hours ④
unless the fee is paid.
Attackers now write fluent, personalised emails in seconds. Filters struggle with messages that look legitimate. The last line of defence is a person deciding whether to click — so train the person.
Phishing, beforeEasy to spot
Dear costumer,
You acount has been suspend due to unusuall activity. Kindly verify you details imediately.
Phishing, nowLooks real
Hi Priya,
Following this year's review, your updated salary and benefits letter is now available. Please read and acknowledge it by Friday.
Best wishes, People Team
[02] What you get
A security team's habit, without the security team.
01
Practice lures modelled on real UK scams — parcels, tax refunds, invoices, logins — never a real brand's logo.
02
Every click becomes a 60-second lesson, not a telling-off.
03
Connect in two clicks. Your staff list syncs itself, leavers drop off.
04
Proof for insurers and annual box-ticking Cyber Essentials, all year round.
Campaigns
Random times. Real working hours.
Pick dates and a lure, or a random mix. Each person gets one practice email at an unpredictable moment on a UK working day — so nobody can warn the office.
Mon–Fri · Europe/London● scheduled
09:0011:0013:0015:0017:00
The lesson
Clicked? Learn why in 60 seconds.
Practice email from Acme's security trainingGood news: this one wasn't real.
A tiny fee is a classic trick to collect card details
A 24-hour deadline pushes you to act before you think
The sender's domain isn't a courier you use
People
Synced from your directory.
Priya Shahincluded
Tom Elleryincluded
Amara Okaforincluded
Reception deskexcluded
Jack Lowesuspended · inactive
Tracking
Link-scanning bots don't count as clicks.
10:42:07 GET /l/8f2c… scanner → ignored
10:42:07 GET /l/8f2c… scanner → ignored
11:16:52 GET /l/8f2c… open
11:16:53 POST /t/8f2c…/click human → recorded
Clicks are recorded by the lesson page itself, so your numbers reflect people — not email security software.
Overview
See the team get sharper.
24Sent
19Opened
3Clicked
Last 30 days · demo workspace
Safety
It can only ever email your people.
X-Lureproof-Simulation: acme.co.uk
Recipients come only from your connected tenant. There is no free-text recipient field. Anywhere. Every practice email is tagged so your filters and IT can recognise it.
LeaderboardSOON
Make spotting scams a team sport.
1Finance1,240
2Operations1,105
3Sales980
Points for reporting lures and finishing lessons. Celebrates spotters — never names clickers.
[03] How it works
Set up before your coffee cools.
STEP 01
Connect
Sign in with your Google Workspace or Zoho admin account (Microsoft 365 coming soon). Your staff list syncs automatically. Personal accounts are rejected.
STEP 02
It runs itself
Staff get practice emails based on real UK scam patterns at random times between 09:00 and 17:00. Allowlisting steps and a "send me a test" button are built in.
STEP 03
See progress
Track who opened and who clicked, and watch the team improve month on month. Share the results with your insurer or Cyber Essentials assessor.
[04] The lure library
Eight lures in the box. From obvious to nasty.
difficulty
Delivery
Parcel redelivery fee
"Action required: your parcel is on hold (£1.99 fee)"
Finance
Tax refund
"You are eligible for a tax refund of £326.40"
Account
Mailbox full
"Mailbox storage 98% full: messages will be rejected"
Account
Password expiring
"Your password expires today"
Document
Shared document
"A document has been shared with you: Q4 Budget.xlsx"
Finance
Overdue invoice
"OVERDUE: Invoice INV-20931 – final reminder"
Document
New voicemail
"New voicemail from +44 7700 900481 (0:42)"
HR
Salary review
"Confidential: your 2027 salary review"
[05] Trust
A security tool that behaves like one.
You're trusting us with your directory. Here's what that means in practice.
✓
Admin-only sign-in.Connecting proves admin rights because the directory API is admin-only.
✓
Tokens encrypted.Provider refresh tokens are AES-GCM encrypted at rest. Sessions are httpOnly; only token hashes are stored.
✓
No real brands impersonated.Lures use generic, made-up senders — never real company names or logos.
✓
Separate lure domains.Practice emails send from dedicated domains with SPF, DKIM and DMARC.
✓
Leavers drop off.People removed or suspended in your directory become inactive automatically.
[06] Pricing
One flat price. No per-seat maths.
Monthly, no annual lock-in, no sales calls. Billed in your local currency.
Billed in your currency. Tax calculated at checkout.
Lureproof is phishing simulation and security awareness training for small teams of 5–50 people on Google Workspace or Zoho Workplace. It sends realistic practice phishing emails each month, and anyone who clicks gets a 60-second lesson showing the red flags they missed.
Why does phishing training matter more now AI exists?+
AI lets attackers write fluent, personalised phishing at scale — no typos, no broken English. Filters struggle with messages that look legitimate. Regular practice teaches people to check senders, links and pressure tactics instead of spelling.
Can Lureproof email people outside my company?+
No. Practice emails only ever go to employees synced from the tenant you connect. There is no free-text recipient field anywhere in the product, and every email carries an X-Lureproof-Simulation header.
Do staff get told off when they click?+
Never. The lesson page opens with "Good news: this one wasn't real", reassures them nothing bad happened, and walks through the warning signs in about 60 seconds.
Will my spam filter block the practice emails?+
The Email setup page gives you step-by-step allowlisting for Google or Zoho, plus a "send me a test" button so you can check delivery before a campaign starts.
Does it help with Cyber Essentials or cyber insurance?+
Yes. Lureproof records who received, opened and clicked each practice email, so you can show insurers and assessors that staff get ongoing phishing awareness training.
Which email platforms do you support?+
Google Workspace and Zoho Workplace today. Microsoft 365 is coming soon, with more providers on the roadmap. See integrations.
How is it different from enterprise awareness platforms?+
It's built for teams without an IT department: flat monthly pricing from £0, two-click setup, no sales calls, and nothing to configure once it's running.
