Everything a security team does about phishing. On autopilot.

Sign in once. Your team appears.

Sign in with your Google Workspace or Zoho admin account — Microsoft 365 is coming soon. Lureproof reads your directory (names, emails, account status) and keeps it in sync. Suspended or removed accounts become inactive automatically.

• ✓ Read-only directory access
• ✓ Exclude anyone with one click
• ✓ Personal accounts rejected

Unpredictable on purpose.

Choose a date range and a lure, or let Lureproof mix them. Each person gets one practice email at a random time between 09:00 and 17:00 on a working day. Nobody gets the same email at the same moment, so nobody can warn the office.

The best lesson lands the second they click.

No modules, no quizzes, no blame. A friendly page opens instantly: it confirms nothing bad happened and shows the exact red flags in the email they just fell for. It takes about a minute, and it sticks.

The email you just clicked was a practice phishing email. Nothing bad has happened, and you haven't done anything wrong.

1. "Keep current password" isn't a real IT process
2. The link isn't your company's sign-in page
3. IT came from an outside domain

Numbers you can trust. And show.

See who received, opened and clicked. Link-scanning bots are filtered out because clicks are recorded by the lesson page itself. Share the results with your cyber insurer or Cyber Essentials assessor.

A leaderboard that rewards reporting.

Turn security into a friendly competition. Teams climb the organisation leaderboard by spotting and reporting practice emails, finishing training and keeping streaks. It celebrates the people who catch lures — it never names the people who clicked.

• ✓ Ranked by department or team
• ✓ Points for reports, lessons and streaks
• ✓ Monthly winners to shout about

Shipping in public.