[metadata]
apple-mobile-web-app-title: Fallax
description: Internal phishing simulations that teach your team at the moment they click, and produce audit evidence for ISO 27001, SOC 2, NIS2, DORA, PCI DSS and HIPAA.
og:description: Internal phishing simulations that teach your team at the moment they click, and produce audit evidence for ISO 27001, SOC 2, NIS2, DORA, PCI DSS and HIPAA.
og:image: https://fallax.io/og.png
og:image:alt: Fallax: phishing simulation and security awareness, with audit-ready evidence.
og:image:height: 630
og:image:width: 1200
og:site_name: Fallax
og:title: Fallax: Phishing Simulation & Awareness
og:type: website
og:url: https://fallax.io
theme-color: #121216
twitter:card: summary_large_image
twitter:description: Internal phishing simulations that teach your team at the moment they click, and produce audit evidence for ISO 27001, SOC 2, NIS2, DORA, PCI DSS and HIPAA.
twitter:image: https://fallax.io/og.png
twitter:title: Fallax: Phishing Simulation & Awareness
viewport: width=device-width, initial-scale=1

[canonical-links]
https://fallax.io

[document-links]
5.0 on G2 Rated 5 out of 5 on G2.: https://www.g2.com/products/fallax/reviews
About: /about
Add yours: https://www.g2.com/products/fallax/take_survey
All alternatives: /alternatives
All comparisons: /vs
All integrations: /integrations
App discovery: /features/app-discovery
Blog: /blog
By industry: /industries
Careers: /careers
Compliance frameworks: /compliance
Contact: /contact
Continuous programme: /features/continuous-programme
Create your workspace: https://app.fallax.io/login
DMARC generator: /tools/dmarc-record-generator
DPA: /dpa
Developer docs: /docs
Drata: /integrations/drata
Fallax: /
G2: https://www.g2.com/products/fallax/
Google Workspace: /phishing-simulation/google-workspace
Gophish: /vs/gophish
Header analyzer: /tools/email-header-analyzer
How Fallax picks the brand to forge: /features/app-discovery
Hoxhunt: /vs/hoxhunt
KnowBe4: /vs/knowbe4
MCP server: /docs/mcp
MSPs: /msp
Microsoft 365: /phishing-simulation/microsoft-365
Microsoft ASM: /vs/microsoft-attack-simulation
Phishing simulation: /phishing-simulation
Press kit: /press
Pricing: /pricing
Privacy: /privacy
Proofpoint: /vs/proofpoint
Regulation (EU) 2016/679 GDPR compliant: /trust
Report inbox: /features/report-inbox
Secureframe: /integrations/secureframe
See pricing: /pricing
Sign in: https://app.fallax.io/login
Spoofing checker: /tools/domain-spoofing-checker
Sprinto: /integrations/sprinto
Standings: /features/standings
Start a simulation: https://app.fallax.io/login
Start free: https://app.fallax.io/login
Startups: /startups
Terms: /terms
Trust center: /trust
Vanta: /integrations/vanta
Verified page: /features/verified-page
https://startupfa.me/s/fallax?utm_source=fallax.io
https://www.linkedin.com/company/fallax/
https://www.youtube.com/@Fallax_IO
https://x.com/fallax_io

[structured-data]
{"@context":"https://schema.org","@id":"https://fallax.io/#fallax","@type":"SoftwareApplication","applicationCategory":"SecurityApplication","applicationSubCategory":"Phishing simulation and security awareness training","description":"Internal phishing simulations that teach your team at the moment they click, and produce audit evidence for ISO 27001, SOC 2, NIS2, DORA, PCI DSS and HIPAA.","featureList":["Unlimited campaigns","The continuous programme","Unlimited admins and members","Google Workspace & Microsoft 365 delivery","Every template and landing page","Training when someone clicks","Full evidence export, CSV and PDF","Continuous sync to your compliance platform","Slack and Teams notifications","Google and Microsoft Entra SSO","Complete event history"],"name":"Fallax","offers":[{"@type":"AggregateOffer","description":"The first 10 seats are free, permanently. Paid seats run from €1.00 down to €0.40 per seat per month, billed annually.","highPrice":"1.00","lowPrice":"0.00","offerCount":5,"offers":[{"@type":"Offer","availability":"https://schema.org/InStock","name":"First 10 seats","price":"0.00","priceCurrency":"EUR","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.00","priceCurrency":"EUR","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 11–100","price":"1.00","priceCurrency":"EUR","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"1.00","priceCurrency":"EUR","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 101–250","price":"0.80","priceCurrency":"EUR","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.80","priceCurrency":"EUR","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 251–1,000","price":"0.60","priceCurrency":"EUR","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.60","priceCurrency":"EUR","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 1,001 and above","price":"0.40","priceCurrency":"EUR","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.40","priceCurrency":"EUR","unitText":"seat"}}],"priceCurrency":"EUR"},{"@type":"AggregateOffer","description":"The first 10 seats are free, permanently. Paid seats run from €1.00 down to €0.40 per seat per month, billed annually.","highPrice":"1.00","lowPrice":"0.00","offerCount":5,"offers":[{"@type":"Offer","availability":"https://schema.org/InStock","name":"First 10 seats","price":"0.00","priceCurrency":"USD","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.00","priceCurrency":"USD","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 11–100","price":"1.00","priceCurrency":"USD","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"1.00","priceCurrency":"USD","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 101–250","price":"0.80","priceCurrency":"USD","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.80","priceCurrency":"USD","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 251–1,000","price":"0.60","priceCurrency":"USD","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.60","priceCurrency":"USD","unitText":"seat"}},{"@type":"Offer","availability":"https://schema.org/InStock","name":"Seats 1,001 and above","price":"0.40","priceCurrency":"USD","priceSpecification":{"@type":"UnitPriceSpecification","billingDuration":"P1M","price":"0.40","priceCurrency":"USD","unitText":"seat"}}],"priceCurrency":"USD"}],"operatingSystem":"Web","publisher":{"@id":"https://fallax.io/#organization"},"url":"https://fallax.io"}
{"@context":"https://schema.org","@id":"https://fallax.io/#organization","@type":"Organization","address":{"@type":"PostalAddress","addressCountry":"BE"},"logo":"https://fallax.io/icon-512.png","name":"Fallax","sameAs":["https://x.com/fallax_io","https://www.youtube.com/@Fallax_IO","https://www.linkedin.com/company/fallax/"],"url":"https://fallax.io"}
{"@context":"https://schema.org","@id":"https://fallax.io/#website","@type":"WebSite","alternateName":["fallax","Fallax.io","Fallax phishing simulation"],"description":"Internal phishing simulations that teach your team at the moment they click, and produce audit evidence for ISO 27001, SOC 2, NIS2, DORA, PCI DSS and HIPAA.","inLanguage":"en","name":"Fallax","publisher":{"@id":"https://fallax.io/#organization"},"url":"https://fallax.io"}
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","acceptedAnswer":{"@type":"Answer","text":"Yes. Mail goes only to recipients you upload, delivered inside your own tenant, and every link points at your own landing page. Get sign-off from HR or your works council before the first campaign, and tell people afterwards that the programme exists."},"name":"Is it safe to run this against our own staff?"},{"@type":"Question","acceptedAnswer":{"@type":"Answer","text":"Nobody. Each person gets their own schedule, adjusted by how they handled the last simulation. You set a monthly cap and a minimum gap between sends, and you can pause the queue at any time."},"name":"Who has to run this month to month?"},{"@type":"Question","acceptedAnswer":{"@type":"Answer","text":"No. When someone submits a login form we record that it happened and the field names. The values are never stored."},"name":"Do you store the credentials people submit?"},{"@type":"Question","acceptedAnswer":{"@type":"Answer","text":"No. Simulations never touch the public email system. Each one is injected into the mailbox through your own Google Workspace or Microsoft 365 tenant, so there is no sending domain and no SPF, DKIM or DMARC to configure."},"name":"Will this damage our email reputation?"},{"@type":"Question","acceptedAnswer":{"@type":"Answer","text":"One export covers ISO 27001 A.6.3, SOC 2 CC1.4 and CC2.2, NIS2 Article 21(2)(g), DORA Article 13(6), PCI DSS 12.6.3.1, HIPAA §164.308(a)(5), GDPR Article 32 and NIST CSF PR.AT-01. Connect Vanta, Drata, Secureframe or Sprinto and the evidence syncs automatically. A blocked or undelivered message is never counted as training."},"name":"Which compliance frameworks does this produce evidence for?"},{"@type":"Question","acceptedAnswer":{"@type":"Answer","text":"Yes. Your data stays in the European Union, all 5 sub-processors are named in Annex III of the DPA, and the DPA is part of the terms. The only one outside the EU is Stripe, which sees billing details and nothing else. There is no ad-tech, and the optional cookie stays off until you accept it."},"name":"Is Fallax itself GDPR compliant?"}]}

[content]
Fallax: Phishing Simulation & Awareness
Skip to content
Fallax
Product
Solutions
Integrations
Blog
Pricing
Sign in
Start free
Where your team learns to spot phishing,
and you get the evidence.
Simulations on autopilot inside your own
Google Workspace
or
Microsoft 365
tenant, training when someone clicks, and evidence your auditor accepts.
Start a simulation
No DNS or allowlisting
First 10 seats free
GDPR compliant, EU-hosted
People
/
People
487
Name
Security score
An De Smet
Fair
Dana Kim
Strong
Jonas Peeters
Exposed
Marc Laurent
Strong
Mia Kovács
Fair
Milan Ricci
Strong
Sara Lindqvist
Strong
Tomas Berg
Strong
Jonas Peeters
submitted their password
Trained at that moment
3 people
reported a simulation
Credited automatically
Evidence synced to
Vanta
487 dated training records
As seen on
Reddit
Product Hunt
Hacker News
G2
Every layer is covered, except your people.
What your stack already covers
Firewall
Handled
Secure email
Handled
Endpoint protection
Handled
Multi-factor auth
Handled
What your people meet alone
Microsoft
microsoft.com
Your password expires today
One click and the account is gone.
It looked like any other message that day.
Everything a phishing programme needs.
every 2 weeks
every 5 weeks
every 8 weeks
Runs itself.
One schedule per person, adjusted by their last result.
0
Delivery that can't miss.
No sending domains, no DNS records, no spam folders.
Microsoft OneDrive
Amelia
shared a file with you
XLSX
Q3 Budget - Final.xlsx
Lures your people believe.
Built from the apps your tenant reports in use.
Nice catch, Marco
+140 points
6 reports in a row
Everyone who reports hears back.
A thank-you when they report, with the points and streak they earned.
CSV
Vanta
Drata
Secureframe
Sprinto
Reported
Trained
Clicked
One export for every auditor.
A timestamped row per person, in the shape every framework asks for.
Lures that look like ordinary mail
The brands your people use and the subject lines they open every week.
Each lure ships with its sign-in page, translated
Ranked by the apps your tenant already uses
Fork any lure, or paste your own HTML
How Fallax picks the brand to forge
Microsoft
microsoft.com
Microsoft account unusual sign-in activity
08:00
Google
google.com
Marco Rossi shared a document with you
08:37
DocuSign
docusign.net
Please DocuSign: Invoice INV-48210
09:14
ADP
adp.com
Action required: verify your direct deposit
09:51
Workday
myworkday.com
Open Enrollment is now available in Workday
10:28
Okta
okta.com
Action required: set up multi-factor authentication
11:05
Dropbox
dropbox.com
Amelia Vermeulen shared "Q3 Forecast & Headcount.xlsx" with you
11:42
Slack
slack.com
You've been added to the Acme Slack
12:19
Zoom
zoom.us
Cloud recording: Quarterly Business Review is available
12:56
Salesforce
salesforce.com
Action required: your Salesforce password expires today
13:33
LinkedIn
linkedin.com
Marco Rossi would like to connect on LinkedIn
14:10
GitHub
github.com
[GitHub] A new sign-in to your account
14:47
Adobe
adobesign.com
Please review and sign: Master Services Agreement 2026
15:24
Atlassian
atlassian.net
Marco Rossi mentioned you on 'Q3 Planning'
16:01
Box
box.com
Jonas Peeters shared "Q3 Planning.xlsx" with you on Box
16:38
QuickBooks
intuit.com
Invoice 48210 from Meridian Goods is due today
08:15
ServiceNow
service-now.com
Approval requested: REQ0048210 (VPN access)
08:52
Mimecast
mimecast.com
[Mimecast] You have 3 held messages
09:29
Microsoft
microsoft.com
Microsoft account unusual sign-in activity
08:00
Google
google.com
Marco Rossi shared a document with you
08:37
DocuSign
docusign.net
Please DocuSign: Invoice INV-48210
09:14
ADP
adp.com
Action required: verify your direct deposit
09:51
Workday
myworkday.com
Open Enrollment is now available in Workday
10:28
Okta
okta.com
Action required: set up multi-factor authentication
11:05
Dropbox
dropbox.com
Amelia Vermeulen shared "Q3 Forecast & Headcount.xlsx" with you
11:42
Slack
slack.com
You've been added to the Acme Slack
12:19
Zoom
zoom.us
Cloud recording: Quarterly Business Review is available
12:56
Salesforce
salesforce.com
Action required: your Salesforce password expires today
13:33
LinkedIn
linkedin.com
Marco Rossi would like to connect on LinkedIn
14:10
GitHub
github.com
[GitHub] A new sign-in to your account
14:47
Adobe
adobesign.com
Please review and sign: Master Services Agreement 2026
15:24
Atlassian
atlassian.net
Marco Rossi mentioned you on 'Q3 Planning'
16:01
Box
box.com
Jonas Peeters shared "Q3 Planning.xlsx" with you on Box
16:38
QuickBooks
intuit.com
Invoice 48210 from Meridian Goods is due today
08:15
ServiceNow
service-now.com
Approval requested: REQ0048210 (VPN access)
08:52
Mimecast
mimecast.com
[Mimecast] You have 3 held messages
09:29
1Password
1password.com
A vault item was shared with you
10:06
Auth0
auth0.com
Security alert: a new administrator was added to your Auth0 tenant
10:43
OneLogin
onelogin.com
Re-authentication required for your OneLogin portal
11:20
JumpCloud
jumpcloud.com
Your JumpCloud password expires soon
11:57
Notion
notion.so
Marco Rossi mentioned you in Q3 Planning
12:34
Proofpoint
proofpoint.com
[Proofpoint] End User Digest: 3 messages in quarantine
13:11
Duo Security
duosecurity.com
Enrol your new device in Duo
13:48
Ping Identity
pingidentity.com
Approval required: new application access in PingOne
14:25
LastPass
lastpass.com
New device signed in to your LastPass vault
15:02
Bitwarden
bitwarden.com
New device logged in to your Bitwarden account
15:39
Dashlane
dashlane.com
Confirm your new device to access your vault
16:16
Cloudflare
cloudflare.com
Your Cloudflare Access login code
16:53
Yubico
yubico.com
Register your YubiKey to keep account access
08:30
Rippling
rippling.com
A new app is ready for you in Rippling
09:07
Zoho
zoho.com
Your Zoho Mail storage is almost full
09:44
Barracuda
barracuda.com
[Barracuda] You have 3 messages in quarantine
10:21
Amazon
amazon.com
Amazon: we noticed unusual sign-in activity
10:58
Microsoft Azure
azure.microsoft.com
Action needed: your Azure subscription payment failed
11:35
1Password
1password.com
A vault item was shared with you
10:06
Auth0
auth0.com
Security alert: a new administrator was added to your Auth0 tenant
10:43
OneLogin
onelogin.com
Re-authentication required for your OneLogin portal
11:20
JumpCloud
jumpcloud.com
Your JumpCloud password expires soon
11:57
Notion
notion.so
Marco Rossi mentioned you in Q3 Planning
12:34
Proofpoint
proofpoint.com
[Proofpoint] End User Digest: 3 messages in quarantine
13:11
Duo Security
duosecurity.com
Enrol your new device in Duo
13:48
Ping Identity
pingidentity.com
Approval required: new application access in PingOne
14:25
LastPass
lastpass.com
New device signed in to your LastPass vault
15:02
Bitwarden
bitwarden.com
New device logged in to your Bitwarden account
15:39
Dashlane
dashlane.com
Confirm your new device to access your vault
16:16
Cloudflare
cloudflare.com
Your Cloudflare Access login code
16:53
Yubico
yubico.com
Register your YubiKey to keep account access
08:30
Rippling
rippling.com
A new app is ready for you in Rippling
09:07
Zoho
zoho.com
Your Zoho Mail storage is almost full
09:44
Barracuda
barracuda.com
[Barracuda] You have 3 messages in quarantine
10:21
Amazon
amazon.com
Amazon: we noticed unusual sign-in activity
10:58
Microsoft Azure
azure.microsoft.com
Action needed: your Azure subscription payment failed
11:35
Brand names and logos are their owners' trademarks, shown only to identify what these simulations imitate. Not affiliated with or endorsed by any of them.
You've done this the hard way before.
The usual way
Delivery
A new sending domain, plus SPF, DKIM, DMARC and allowlisting
Rollout
One quarterly blast to the whole company at once
Training
A course link most people close and forget
Reporting
A report button, if there is one at all
Audit day
A week of screenshots, stitched together by hand
With Fallax
Delivery
Injected inside your own Google Workspace or Microsoft 365
Rollout
A schedule per person, running continuously
Training
A lesson when they click
Reporting
A thank-you and points for everyone who reports
Audit day
One export, or a sync into your compliance platform
Free for your first
10
people
Then
$1.00
a seat, falling as you grow. Every account gets the whole product.
See pricing
People you want to test
Yearly
Monthly
$40
/month
$480 a year, billed once · $0.80 a seat
1
10
100
250
1,000
5,000+
How that adds up
First 10 seats
10 seats
Free
Seats 11–100
40 × $1.00
$40
Seats 101–250
$0.80 a seat
—
Seats 251–1,000
$0.60 a seat
—
Seats 1,001 and above
$0.40 a seat
—
What security teams ask first
Is it safe to run this against our own staff?
Yes. Mail goes only to recipients you upload, delivered inside your own tenant, and every link points at your own landing page. Get sign-off from HR or your works council before the first campaign, and tell people afterwards that the programme exists.
Who has to run this month to month?
Nobody. Each person gets their own schedule, adjusted by how they handled the last simulation. You set a monthly cap and a minimum gap between sends, and you can pause the queue at any time.
Do you store the credentials people submit?
No. When someone submits a login form we record that it happened and the field names. The values are never stored.
Will this damage our email reputation?
No. Simulations never touch the public email system. Each one is injected into the mailbox through your own Google Workspace or Microsoft 365 tenant, so there is no sending domain and no SPF, DKIM or DMARC to configure.
Which compliance frameworks does this produce evidence for?
One export covers ISO 27001 A.6.3, SOC 2 CC1.4 and CC2.2, NIS2 Article 21(2)(g), DORA Article 13(6), PCI DSS 12.6.3.1, HIPAA §164.308(a)(5), GDPR Article 32 and NIST CSF PR.AT-01. Connect Vanta, Drata, Secureframe or Sprinto and the evidence syncs automatically. A blocked or undelivered message is never counted as training.
Is Fallax itself GDPR compliant?
Yes. Your data stays in the European Union, all 5 sub-processors are named in Annex III of the DPA, and the DPA is part of the terms. The only one outside the EU is Stripe, which sees billing details and nothing else. There is no ad-tech, and the optional cookie stays off until you accept it.
Nothing to allowlist, no spreadsheet to maintain, and our last ISO 27001 audit took one export instead of two weeks of screenshots.
Ignace Maes
CTO, Squire
5.0
on G2
Rated
5
out of 5 on G2.
from a handful of reviews.
Add yours
Give your team the practice
before an attacker does.
Connect your workspace and switch the programme on this afternoon. The first
10
seats are free.
Create your workspace
See pricing
Fallax
Internal phishing simulation and security awareness training that doubles as audit evidence.
Regulation (EU) 2016/679
GDPR compliant
Product
Phishing simulation
Continuous programme
App discovery
Report inbox
Standings
Verified page
Pricing
Free tools
Spoofing checker
Header analyzer
DMARC generator
Solutions
Google Workspace
Microsoft 365
Compliance frameworks
By industry
Startups
MSPs
Integrations
All integrations
Vanta
Drata
Secureframe
Sprinto
MCP server
Developer docs
Compare
KnowBe4
Proofpoint
Hoxhunt
Microsoft ASM
Gophish
All comparisons
All alternatives
Company
Blog
About
Careers
Press kit
Contact
Trust center
©
2026
Fallax
·
Built in Ghent, Belgium 🇪🇺
Privacy
Terms
DPA
Fallax
