PhishCope measures how your team spots phishing while a deadline is running, a chat keeps pinging and the inbox won't stop, then trains the habits that hold up in exactly those moments.
The test runs in your browser. Nothing you click is sent anywhere.
Hi,
We detected unusual sign-in activity on your account. To keep access, confirm your credentials within 30 minutes.
Link goes to: yourcompany.verify-login.co/authIf you don't confirm, email and Teams access will be removed at 15:00.
IT Service Desk
In a PhishCope assessment this is one of dozens of decisions, each made under a different kind of pressure. The pattern across them is what we measure.
A quiz taken with a coffee in hand says little about the click that happens at 16:55 on a Friday. Attackers know this, so their emails arrive with deadlines and urgency built in.
A countdown, a payment due today, a mailbox about to be closed. Less time means fewer cues checked.
A chat message lands mid-decision. Attention splits, and the second task usually wins.
A manager waiting, colleagues who already replied. Nobody wants to be the slow one.
Four stages, repeated over time so you can see whether training actually changes behaviour.
A short questionnaire maps how each person tends to handle pressure: by tackling the task, by reacting emotionally, or by stepping away from it. It takes a few minutes and frames everything that follows.
People sort a realistic inbox of genuine and phishing emails while one stressor at a time is switched on.
For each stressor we measure hits, false alarms and sensitivity (d′). That separates people who get careless under pressure from people who get jumpy and report everything, two problems that need opposite fixes.
Short lessons built around each person's profile and the conditions that tripped them up. Then we test again under the same pressure and show what changed.
We use Anthropic's Claude models where a fixed library of templates falls short.
Claude generates phishing and genuine emails in your company's language, tools and tone. Every round is fresh, so nobody can pass by memorising last quarter's test.
After every answer, a short breakdown of the cues that mattered, written for the person who just made the call.
Lessons adapt to how someone handles pressure. An avoidant coper and a task-focused one need different advice.
Security leads get team-level patterns and what to do about them, not a spreadsheet of who failed.
Simulations never collect passwords or personal data, run only for people who agreed to take part, and are generated inside a closed training environment.
PhishCope grew out of a study we are running now. Participants complete a validated coping-style inventory, then classify simulated emails as legitimate or phishing while exposed to acute stressors: time pressure, social evaluation, visual interference, surveillance, cognitive overload and negative feedback.
The question is simple. Does the way someone copes with stress predict how their judgement changes under it? If it does, training can be aimed at the person instead of averaged across a whole company.
We will publish results here when the study is complete.
Results are for learning, not for naming and shaming. Individual results stay with the individual unless your organisation and the participant agree otherwise.
Everyone taking part knows they are in the programme and what is measured.
We collect what the analysis needs and nothing more, and design for GDPR from the start.
We're opening a small pilot for teams in Poland and the EU. Tell us about your team and we'll reply within a few working days.
PhishCope is in early development. Pilot teams help shape what we build.