PhishLens tests staff with realistic phishing simulations, trains
them by role in English and Arabic, issues a personalised certificate to
everyone who passes, and files every result to the control it evidences
in your ISO 27001, NCA ECC, ADHICS, RMiT, POPIA or other assessment.
Leadership sees a governance dashboard. The awareness team sees a work
queue. The auditor sees dated evidence.
Request a
demonstration · Explore
the platform
At a glance
| Module type | People and awareness module of the GRCLens platform |
| Simulation | Email campaigns with credential, attachment and QR scenarios; scheduled dispatch; safe dry-run gate |
| Training | 2 foundation courses, 6 role modules, 12 micro-lessons; pass mark, retake rule, auto-enrolment |
| Governance | Executive dashboard, operations queues, 15-KPI programme scorecard, quarterly snapshot |
| Certificates | Personalised PDF per participant, unique number, public verification, 12-month validity |
| Languages | English and Modern Standard Arabic, right to left, locale ar-AE or ar-SA per tenant |
| Evidence | Filed as dated lines against the control, never setting a status on its own |
| Deployment | Cloud tenant or on premise |
Why a checklist is not a
programme
Most frameworks ask for the same three things: awareness is delivered
periodically, staff in sensitive roles are trained before access, and
the programme’s effectiveness is evaluated. A once-a-year video and a
one-off phishing test satisfy none of them well. PhishLens is built
around those three requirements, so the evidence an auditor asks for is
produced by the programme running, not assembled afterwards.
What PhishLens does
PhishLens is the people module of the GRCLens platform. It covers the
full awareness programme, not just the phishing test.
Phishing simulation. Template-driven campaigns in
email, with credential, attachment and QR code scenarios, scheduled
dispatch to departments, groups or named people, and a safe dry-run gate
so nothing leaves until you open it. Analytics cover delivery, opens,
clicks, credentials entered, reports, phish-prone rate and repeat
clickers over 90 days.
Security awareness training. Two foundation courses,
six role modules and twelve micro-lessons, assigned to all staff,
several departments, groups or individuals, with a pass mark, a retake
rule and automatic enrolment for new starters, simulation clickers and
expiring certificates. Learners open a token link, no login needed.
Governance dashboards. An executive view answers
four questions in aggregates: are we covered, are we on time, is it
working, and can we show it to an auditor. It carries coverage, on-time
completion, first-attempt pass rate, overdue, recertification due,
new-starter induction and a trained-against-untrained click rate, each
coloured against a target the tenant sets. An operations view gives the
awareness team its daily queues: overdue, not started, failed, new
starters, clicked but not trained, leavers, delivery problems and
expiring certificates, with bulk reminders, escalation and an HR
export.
Programme success scorecard. Fifteen KPIs across
reach, learning, behaviour, outcome and culture, read quarterly against
a baseline taken in the first 30 days, each naming the control it
evidences.
Certificates. A personalised completion certificate
for every participant who passes a course: PDF in English, Arabic or
both, a unique number, a public verification page, 12-month validity
with automatic recertification, and a register with revoke and
reissue.
Evidence filed to the control. A campaign, a
completion figure or a quarterly snapshot is filed as a dated line
against the exact control it evidences, inside the framework assessment
in GRCLens. It never changes a control’s status on its own; your
assessor does that.
Board pack. One button exports the executive view as
PDF and PowerPoint, frozen as a quarterly snapshot so a board paper can
be reproduced later.
How a programme runs
- Baseline, days 1 to 30. One simulation before any
training, plus a short pre-test at the start of the first course. Every
target is read against these numbers, not a vendor benchmark. - Train by role, months 2 to 3. Foundation courses
for everyone, role modules before access to sensitive systems, reminders
before and after the due date, manager copied at seven days
overdue. - Validate monthly. Simulations rise in difficulty
through the year. Anyone who clicks gets a short remediation lesson
automatically. - Report quarterly. The scorecard, the department
table and the compliance panel, exported as a board pack and filed as
evidence. - Certify and renew. Certificates issue on a pass,
expire after 12 months and trigger recertification 30 days before expiry
without anyone reassigning by hand.
Where PhishLens is used
PhishLens is deployed by organisations assessed against regional and
sector frameworks. Country pages cover the local regulators, languages
and deployment options:
- United Arab
Emirates: ADHICS v2, UAE IA Standard, DESC ISR, CBUAE, PDPL - Saudi
Arabia: NCA ECC 2:2024, SAMA CSF, OTCC, PDPL, CST CRF - Qatar: NIAS,
QCB, PDPPL - Kuwait:
Central Bank of Kuwait framework, national baseline controls - Oman:
CBO Cyber Security Regulatory Framework, PDPL - Malaysia:
BNM RMiT, Cyber Security Act 854, PDPA - South
Africa: FSCA and SARB Joint Standard 2, POPIA
Frequently asked questions
Is PhishLens a compliance
framework?
No. It is the module that produces the tested-awareness and training
evidence that framework controls require. The frameworks themselves live
in GRCLens.
Which
frameworks can evidence come from PhishLens?
Any framework in GRCLens with an awareness or training control: ISO
27001:2022 A.6.3, NIST CSF 2.0 PR.AT, NCA ECC 2:2024 domain 1-10, ADHICS
v2 HR 3.2 to 3.4, NZISM 9.1, SAMA CSF, RMiT, Joint Standard 2, POPIA and
others. Evidence is captured once and mapped to each.
Can
campaigns and certificates be branded per tenant?
Yes. Each tenant sets its sender identity, brand colour, logo and the
signatory whose name appears on certificates, within administrative
limits on targets and permitted domains.
Is it safe to test dispatch?
Yes. A tenant’s sending gate stays in dry run until you open it, so
campaigns and training emails can be built and previewed without
anything leaving.
How are results used in
an assessment?
A campaign, a completion figure or the quarterly scorecard snapshot
is attached as a dated evidence line to the chosen controls. Your
assessor decides the control’s status; PhishLens never sets it
automatically.
Does it handle 2,000 staff?
Yes. Emails are queued and sent at a set hourly rate by the
scheduler, every list is paged, and the executive dashboard is built
from SQL aggregates sized for 80,000 assignments a year.
Talk to us about PhishLens
Request a demonstration and we will run a baseline simulation design
for your organisation, show the executive dashboard with demo data, and
map the evidence to the frameworks you are assessed against.
Request a
demonstration · Explore
the GRCLens platform · On-premise
deployment
