01
Simulated attack
- Meet to agree scope, target departments, sensitivity limits and timing
- Design bespoke phishing emails and fake sites for your industry and workflows
- Send at the agreed time and record behavioural data throughout
What is phishing?
The weakest link in your defences is usually people, not systems.
Criminals impersonate banks and providers in emails that lure staff to fake sites, steal credentials or plant ransomware.
More advanced spear phishing studies your organisation first, then targets specific roles, for example, impersonating the boss to demand an urgent transfer, causing far heavier losses than mass phishing.
Even trained staff fall for a well-crafted scenario. One slip by a single employee can undo years of security investment.
Untrained staff
30%
Median who click a phishing email
Management often overestimates how well staff resist professional phishing.
The testing process in three steps
Run end to end by UD's in-house team and kept confidential, so staff aren't tipped off and the test stays valid.
02
Victim report
- Per-employee click time, device, OS and browser
- Behaviour breakdown: opened / clicked / submitted / downloaded / reported
- Strengths-and-weaknesses analysis and cross-department comparison
Sample report · 100 sent
Sent100
Clicked84
Submitted data42
Reported it0
03
Awareness training
- UD security experts teach on-site in person, not self-paced videos
- Covers attack techniques, latest trends and real local cases
- Extra focus for staff who fell for it, education, not punishment
Why choose UD phishing testing
We don't use cookie-cutter templates. Every test starts by studying your business and communication style, so the results reflect real risk.
Attack scenarios tailored to your company, departments and workflows
HR, finance, IT and customer service each face different attacks. During scoping we study your org structure and everyday communications, then design phishing content that fits real scenarios, because only tailored tests reflect real risk.
HRFake job-applicant CV attachment
FinanceFake urgent transfer order from the boss
ITFake system password-reset notice
SupportFake customer-complaint link
Reporting down to the individual
Not just how many fell for it, but each employee's click time, device and OS, plus department comparisons and a full behaviour breakdown.
Security experts teach on-site
In-person, in the local language, staff can ask questions and discuss real scenarios, far more effective than self-paced videos.
Local since 1998 · data stays in HK
4,000+ organisations, 21 international certifications; a 100% local, directly-hired team, test and staff data stay in Hong Kong.
Which businesses need it
For any organisation that runs on email and internal systems, staff awareness is a risk you can't ignore. Executives who handle frequent cross-border transfers are especially high-value spear-phishing targets.
Banking · Fintech · Payments
E-commerce · SaaS · Membership
Listed companies / IPO applicants
Funded NGOs · suppliers
Healthcare · Schools · Education
Frequent-travel execs / cross-border transfers
Done penetration testing or vulnerability scanning but overlooked staff awareness? Human error can undo your technical investment. Phishing testing is the piece your technical defences are missing.
Transparent pricing, from a single run
HK$10,000/ run
Larger scale, multiple rounds, multi-region training, or rolling it into an annual awareness programme? Mention it in your enquiry and we'll quote a combined package.
Get a quote or ask us
Whether you want a formal quote or just have a question, a UD security expert will be in touch shortly to scope the work, discuss test sensitivity and schedule the test and training.
A dedicated specialist follows up
Help defining scope and sensitivity limits
Confidential process, staff aren't tipped off
Frequently asked questions
How is phishing testing different from a penetration test?
Phishing testing targets the people layer, measuring staff awareness and strengthening it, while a penetration test targets the technical layer, simulating real attacks to find system flaws. The two aren't mutually exclusive: best practice is an annual pen test paired with a phishing test every six months, hardening both your technical and human lines of defence.
Will staff resent being "tested"?
In practice, staff who receive the follow-up training appreciate that the company takes awareness seriously. We work with HR to prepare communications in advance and take a non-judgemental, educational approach, the focus is education, not punishment. Staff who fall for it get extra targeted training, and some clients keep individual results confidential, using them only to shape overall strategy.
Will the test disrupt daily operations?
No. We coordinate send times during scoping and avoid peak hours. Every phishing email is carefully designed with no real malicious payload; clicking a link only takes staff to a UD internal tracking page, with no actual system damage.
How often should we run it?
At least one full test a year, paired with a small-scale sample every six months. Add one after major organisational changes (a wave of new hires, a reorg, a new system launch).
Is training on-site or online?
On-site in person by default, with a UD security expert at your office. Multi-branch or cross-border organisations can use a hybrid: in-person at the local office plus video training for branches. Self-paced online videos are not part of the standard package.
How many employees does HK$10,000 / run cover?
Tell us your headcount in the enquiry and we'll confirm coverage in the formal quote. For large organisations or multiple rounds, we provide a combined-package quote.
How do we get a quote, and what do you need from us?
Submit the form at the foot of the page, noting headcount, target departments, compliance target (HKMA, ISO 27001, PCI-DSS, etc.) and expected timing. A UD security expert will reply shortly, and we provide a formal quote after the meeting.